SSH and SCP

All connections to machines at the Supercomputing Institute must use Secure Shell (ssh) except for those that involve the running of Windows software remotely by means of Citrix ICA Client connections. See http://www.msi.umn.edu/sdvl/sdvlapp1/index.html for more information about access to Windows software by means of Citrix Metaframe. The Supercomputing Institute does not allow connections to its machines via telnet, rlogin, rsh, rcp or rexec. These programs compromise both the security of the Institute and the Institute's users by transfering passwords in plain text and by not securely authenticating connections. You may discover that certain software packages you use that use telnet, rsh, rexec, or other insecure programs to execute commands on remote machines no longer work and will need you to change how you use the programs.

SSH provides extra convenience including an array of flexible authentication mechanisms that can allow one to authenticate without having to type in a password every time (without compromising security), automatic X forwarding that frees one from having to set DISPLAY manually on every connection and also lets one use X behind a firewall.

If you connect to the Institute's machines from home through the University's modem pool, you will connect as you usually do and then use ssh instead of telnet. You will need to install an SSH client on your home machine. SSH is now very common and is installed on most machines. If it isn't installed on your machine, you or your system administrator will have to install it.

You should use secure copy (scp) instead of ftp to transfer files. The secure copy is more flexible than ftp in that it allows you to transfer directories from one machine to another in addition to just files. There are graphical user interfaces for Windows and for Macs.

If you want to run X Window applications from a UNIX machine and send the display to a Macintosh or a PC running Microsoft Windows, you will need to install an X Window emulator.

Installing and Using SSH on your machine

SSH is now very common and is installed on most machines. If it isn't installed on your machine, you or your system administrator will have to install an SSH client. For more information on installing SSH clients, see www.msi.umn.edu/user_support/ssh/sshclients.html.

If you have an account on any of the Institute's machines and have difficulties, please contact help@msi.umn.edu or call (612) 626-0802.

Why SSH

In addition, for the more technically minded, SSH can protect against (taken from the SSH README):

• IP spoofing, where a remote host sends out packets which pretend to come from another, trusted host. Ssh even protects against a spoofer on the local network, who can pretend he is your router to the outside.
• IP source routing, where a host can pretend that an IP packet comes from another, trusted host.
• DNS spoofing, where an attacker forges name server records.
• Interception of cleartext passwords and other data by intermediate hosts.
• Manipulation of data by people in control of intermediate hosts.
• Attacks based on listening to X authentication data and spoofed connection to the X11 server.