Re: Safe SSH logins from public, untrusted Windows computers

From: Brad Jones (brad@kazrak.com)
Date: 03/19/02 

Date: Tue, 19 Mar 2002 13:14:08 -0700
From: Brad Jones <brad@kazrak.com>
To: Chris Johnson <cjohnson@palomine.net>

On Tue, Mar 19, 2002 at 02:45:38PM -0500, Chris Johnson wrote:
> This isn't exactly FreeBSD-security-related, but it's certainly
> security-related, and I think it's likely to be of interest to many of the list
> members.
>
> I spend a lot of time in hotels, and most of them have Internet centers with
> Windows computers for the use of hotel guests. It's easy enough to download a
> copy of PuTTY and hide it in the Windows directory so that I can make SSH
> logins to my various remote servers.
>
> I worry, however, about trojans and keyboard sniffers and what-have-you
> monitoring my keystrokes, so I don't feel particularly safe doing this. So I
> thought I might stick a DSA key, encrypted with a passphrase used only for that
> particular key, on a floppy disk, and use that to log in. Without the floppy
> disk, the passphrase, if sniffed or recorded, would be useless.
>
> Question: if I plan on doing any work as root, would I be better off setting
> PermitRootLogin to without-password and logging in directly as root, instead of
> following the common practive of logging in as a regular user and then su-ing?
> su-ing would require that I type the password, and that's what I'm trying to
> avoid.
>
> Does anyone have any comments, or does anyone have a better idea?

S/Key. It's built-in to FreeBSD, doesn't require any special hardware (just
a bit of planning ahead), and lets you avoid reusable passwords.

Set it up for your account, and set up 'sudo' so you can get to a root shell
without typing a reusable password. Then print up 20-30 responses (or
however many you think you'll need) and go...you enter the one-time password
at the appropriate SSH prompt, and a keystroke sniffer never gets any useful
information. (Sure, they got phrase #94...but that one's been used, and
won't work anymore.)

Recommended man pages: 'keyinit' will get you started, 'key' lets you
create a file of keys that you can print and take with you. (If you have
a palmtop, most of them have key-generation programs you can use instead.)
'skey' gives an overview.

Don't leave home without it.

BJ 

-- 
Brad Jones -- brad@kazrak.com
"The line between good and evil, hope and despair, does not divide the
world between 'us' and 'them'.  It runs down the middle of each one of us."
   -- Robert Fulghum
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages

  • Re: Canon printer and TurboPrint
    ... line to /etc/rc.conf (as root) ... If you want to do a better one refer to the Printing section in the FreeBSD ... I have tried TurboPrint on FreeBSD and it works. ... With this last command you see some new programs installed from the ...
    (freebsd-questions)
  • Re: HOW TO: Enabling root on a new server?
    ... Amusing to hear they are more secure on FreeBSD than linux although its ... this should let you upload a shell script which is then run as root ... (horribly insecure but thats plesk, and if you fiddle with their setting ...
    (freebsd-stable)
  • file system setup for new system - recommendations?
    ... and I ask for your collective help. ... I successfully built a FreeBSD system using defaults. ... I've tried to absorb input from the FreeBSD on-line handbook, ... A Reference says keep the root section small, ...
    (freebsd-questions)
  • Re: [OT] Sony CDs are not safe to play in a Windows computer
    ... >>I run a BSD Unix varient myself called FreeBSD. ... >>this is that if you don't run as root, then it cannot install itself at ... FreeBSD and other Unix varients don't have ... strip view finger mount fcsk more fcsk yes spray umount sleep ...
    (rec.arts.anime.misc)
  • AW: FreeBSD 2.2.9 / Installation problem
    ... I tried to send to freebsd-questions the following twice, ... Betreff: Re: FreeBSD 2.2.9 / Installation problem ... root correctly. ... system where I want to run it, the HP Omnibook, it is ad0. ...
    (freebsd-questions)
Quantcast