Transition to Secure Remote Access

The Computer Systems Lab is transitioning from insecure remote access (such as telnet and ftp, which transmit passwords over the network without encryption) to only allowing secure remote access. This document describes that transition and the steps users need to take in order to continue to remotely access CSL facilities.

Several other computing facilities on campus are undertaking a similar transition.

• Computer Systems Lab Documentation
  • 3 Information and Announcements About Computer Systems Lab Facilities
    • 3.1 Transition to Secure Remote Access
      • 3.1.1 Introduction
      • 3.1.2 Getting Started with SSH
      • 3.1.3 Transition Strategy and Key Dates

---

3.1.1 Introduction

Regular telnet and ftp connections transmit your password over the net in "plaintext" -- your password is not encrypted or protected in any way. It is possible for others to eavesdrop on the network and capture your username and password.

With your username and password, they can then easily use your account, reading or changing your files, electronic mail, etc.

The CSL supports two packages to provide secure remote access: Kerberos and SSH. Both use strong cryptography to protect your passwords and other data. Kerberos telnet and Kerberos-authenticated POP (the Post Office Protocol, for retrieving email from a server) are the default within the CSL network, but are difficult to install and configure at home. Therefore, we are recommending SSH (instead of kerberos) for use from home and other sites.

In addition, we have established the computer route66.cs.wisc.edu as a remote-access host for users who need secure POP connections to pop.cs.wisc.edu or secure FTP connections.

[ Back to Top ]

---

3.1.2 Getting Started with SSH

• For instructions on downloading, installed and using SSH on computers at other sites (including at home), please see HOW-TO use SSH to establish a remote connection and transfer files .
• For answers to frequently asked questions about using SSH with CSL computers, please see SSH (secure shell) in the CSL Frequently Asked Questions

[ Back to Top ]

---

3.1.3 Transition Strategy and Key Dates

Note: Due to faculty concerns regarding the transition, this schedule has been suspended pending discussion by the faculty. The Computer Systems Lab continues to strongly encourage the use of SSH.

Because we know that users will need some time to download and install the SSH software, we have devised the following transition strategy:

• Fall 1998: Acquire SSH software for Unix and Windows:
  • a free Unix implementation of SSH is available for non-commercial use
  • we contributed to a UW-Madison site license for SecureCRT, a commercial implementation of the SSH client for the Windows 95, 98 and NT operating systems.
• January 1999: Provide documentation for using SSH
  
  • SSH (secure shell) FAQ
  • HOW-TO use SSH to establish a remote connection and transfer files
• January 21, 1999: Notify all users of the transition and transition strategy
• January 25, 1999: Initiate warning messages when insecure telnet, ftp or POP are used
• February 15, 1999: Disable insecure telnet, ftp and POP

[ Back to Top ]