Weekly Edition
Return to the Development pageSponsored link
Vyatta –
Linux & Open Source
Alternative to Cisco –
Advanced Routing,
Firewall, VPN, QoS..
Free Download ->
| |||||||||||||
The OpenSSH project turns five
The OpenSSH project turns five years old ---------------------------------------- Five years ago, in late September 1999, the OpenSSH project was started. It began with an audit, cleanup and update of the last free version of Tatu Ylonen's legacy ssh-1.2.12 code. The project quickly gathered pace, attracting a portability effort and, in early 2000, an independent implementation of version 2 of the SSH protocol. Since then, OpenSSH has led in the implementation of proactive security techniques such as privilege separation & auto-reexecution. The free software community were rapid adopters of OpenSSH, with most free operating systems shipping OpenSSH within its first year of existence. Over the last five years OpenSSH has become the most widely used SSH protocol implementation (by a large margin) and has been included in products from major vendors including IBM, Apple, HP, Sun, Cisco and NetScreen. Today, OpenSSH runs on everything from mobile phones to Cray supercomputers. In providing a free, popular and easy to use secure login and command execution protocol OpenSSH has been instrumental in speeding the deprecation of insecure protocols like telnet and rlogin. The OpenSSH team would like to thank all those who have supported the project over the last five years, including individuals and vendors who have donated funds or hardware. An extra special thanks to those who have reported bugs or sent patches to the project. OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt, Kevin Steves, Damien Miller, Ben Lindstrom, Darren Tucker and Tim Rice. http://www.openssh.com/ (Log in to post comments)
The OpenSSH project turns five Posted Sep 28, 2004 14:30 UTC (Tue) by ccezar (guest, #2749) [Link] Happy birthday OpenSSH! ;-)And thank you very much for well done job! :-)
cezar
The OpenSSH project turns five Posted Sep 28, 2004 15:20 UTC (Tue) by philips (guest, #937) [Link] First of all - thanks to everyone from OpenSSH for their work all over this years.
Second. It is still sad to see how M$ Windoz struggles to become a bit more secure, especially when we are talking about network communication.
OpenSSH is crucial part of network communictions protocols nowadays, bringing not only security, but greatly enhanced utility to every its user. Unlike M$ it didn't tryed to be backward compatible, or shall I say backward insecure/bogus/annoying.
Best wishez.
The OpenSSH project turns five Posted Sep 29, 2004 8:29 UTC (Wed) by khim (subscriber, #9252) [Link] OpenSSH is crucial part of network communictions protocols nowadays, bringing not only security, but greatly enhanced utility to every its user. Unlike M$ it didn't tryed to be backward compatible, or shall I say backward insecure/bogus/annoying. Oops. Baaad example. Reeeal baaad example. OpenSSH is the only ssh implementation bug-compatible with ssh protocols from version 1.3 up to version 2.0. True - it defaults to 2.0 and is very secure but backward compatibility is very good with OpenSSH. Better then with most proprietary implementations.
The OpenSSH project turns five Posted Sep 28, 2004 15:35 UTC (Tue) by parimi (subscriber, #5773) [Link] Openssh has truly been one of my favorite applications. Congratulations to the openssh team on bringing out such a great product. Wish you many more years of success!
auto-reexecution ? Posted Sep 28, 2004 16:42 UTC (Tue) by brambi (guest, #2847) [Link] Can someone explain what they mean with 'auto-reexecution' ? Even google can't help this time.
auto-reexecution ? Posted Sep 28, 2004 19:08 UTC (Tue) by smoogen (subscriber, #97) [Link] I think (and am probably wrong) that the sshd daemon's childrens are 're-executed' from clean code by the parent. This is to stop memory injection/overflows of the child processes.
auto-reexecution ? Posted Sep 29, 2004 9:43 UTC (Wed) by hppnq (subscriber, #14462) [Link] I think you're right. The child that inherits the connection does an execv(3), so the whole parent process image is replaced by a new one.
auto-reexecution ? Posted Sep 29, 2004 9:27 UTC (Wed) by dtucker (subscriber, #6575) [Link] What it means is that a new copy of sshd is exec'ed for each connection after the master sshd fork()s to handle the connection. Previously, the forked sshd would just handle the whole session. It starts off as a literal copy of the address space of the parent and stays very similar throughout its life.
Now should there be some kind of vulnerability in sshd, an attacker can connect, get a new fork()ed copy of the master sshd and attempt to guess whatever they need to successfully exploit it. Should they guess wrong, their sshd will likely crash, but they can just connect, get another (identical) copy and try again. Some systems (eg OpenBSD and PAX-based Linuxes like Adamantix) shuffle various things up (library offsets, stack location, ProPolice canaries, whatever) at exec() time. In the case of sshd, re-execing after the fork() means that instead of being able to linearly scan through the possible values needed to conduct the attack, the attacker has to guess the right ones for their current connection. Basically, instead of multiple shots at a stationary target, the attacker is now faced with an environment with lots of moving targets, all of which must be hit in order to conduct a successful attack. This should make it much harder to conduct the exploit. For a look at those moving targets, see Theo de Raadt's Exploit Mitigation Techniques paper.
|
|||||||||||||