Newsgroup: it.comp.sicurezza.varie
Titolo: Quale client SSH2 con Windows?

Quale client SSH2 con Windows conviene usare ed è il + sicuro?

Quale client SSH2 con Windows conviene usare ed è il + sicuro?
Mi trovo bene con PuTTY; di piu' dirti non so.
Leonardo
-- 
Questo messaggio e' NAGWARE. Per disattivare frecciatine, giochi
di parole, volgarita' gratuite ed inviti a rileggersi i messaggi
gia' passati e/o consultare 
http://groups.google.com
, effettuare
un versamento di 25 euro come tariffa di registrazione helpdesk.

 Quale client SSH2 con Windows conviene usare ed è il + sicuro?
Putty è gratis, sicuro non so, ma credo di si :)
-- 
Official mirror of     | 
www.bynoi.org
X-Planet Web Community | 
www.x-planet.org

Quale client SSH2 con Windows conviene usare ed è il + sicuro?
Come ti hanno gia` suggerito, va bene Putty
ma attento a quale versione...
http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html
CERT Advisory CA-2002-36 Multiple Vulnerabilities in SSH Implementations
   Original issue date: December 16, 2002
   Last revised: --
   Source: CERT/CC
[...]
Systems Affected
     * Secure  shell  (SSH)  protocol  implementations in SSH clients and
       servers from multiple vendors
Overview
   Multiple  vendors' implementations of the secure shell (SSH) transport
   layer  protocol  contain  vulnerabilities  that  could  allow a remote
   attacker  to  execute  arbitrary  code  with the privileges of the SSH
   process  or  cause a denial of service. The vulnerabilities affect SSH
   clients  and  servers, and they occur before user authentication takes
   place.
I. Description
   The SSH protocol enables a secure communications channel from a client
   to a server. From the IETF draft SSH Transport Layer Protocol:
     The  SSH  transport layer is a secure low level transport protocol.
     It  provides  strong encryption, cryptographic host authentication,
     and  integrity  protection....  Key  exchange  method,  public  key
     algorithm,  symmetric  encryption algorithm, message authentication
     algorithm, and hash algorithm are all negotiated. 
   Rapid7  has  developed  a suite (SSHredder) of test cases that examine
   the  connection  initialization,  key  exchange, and negotiation phase
   (KEX,  KEXINIT)  of  the SSH transport layer protocol. The suite tests
   the  way  an  SSH  transport  layer  implementation handles invalid or
   incorrect  packet  and  string  lengths,  padding  and padding length,
   malformed strings, and invalid algorithms.
   The  test  suite  has  demonstrated  a  number  of  vulnerabilities in
   different  vendors' SSH products. These vulnerabilities include buffer
   overflows,  and they occur before any user authentication takes place.
   SSHredder  was  primarily  designed  to  test  key  exchange and other
   processes that are specific to version 2 of the SSH protocol; however,
   certain classes of tests are also applicable to version 1.
   Further  information about this set of vulnerabilities may be found in
   Vulnerability Note VU#389665.
   Rapid7  has  published a detailed advisory (R7-0009) and the SSHredder
   test suite.
   Common  Vulnerabilities and Exposures (CVE) has assigned the following
   candidate numbers for several classes of tests performed by SSHredder:
     * CAN-2002-1357 - incorrect field lengths
     * CAN-2002-1358 - lists with empty elements or multiple separators
     * CAN-2002-1359 - "classic" buffer overflows
     * CAN-2002-1360 - null characters in strings
II. Impact
   The  impact  will vary for different vulnerabilities and products, but
   in  severe  cases,  remote attackers could execute arbitrary code with
   the  privileges  of  the SSH process. Both SSH servers and clients are
   affected,  since  both  implement the SSH transport layer protocol. On
   Microsoft  Windows  systems,  SSH  servers  commonly  run  with SYSTEM
   privileges,  and  on UNIX systems, SSH daemons typically run with root
   privileges.  In  the  case  of SSH clients, any attacker-supplied code
   would  run  with  the  privileges  of  the user who started the client
   program,  with  the  possible  exception  of  SSH  clients that may be
   configured  with an effective user ID of root (setuid root). Attackers
   could  also  crash  a  vulnerable  SSH  process,  causing  a denial of
   service.
III. Solution
Apply a patch or upgrade
[...]
PuTTY
     PuTTY 0.53b addresses vulnerabilities discovered by SSHredder.
[...]
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0 - not licensed for commercial use: 
www.pgp.com
iQCVAwUBPjRS6684G+aJbDmvAQFs5AP9HX6WteK6Qop1aOkK8BnEuLt+ns2skk4U
9vsWaBb3PowE/b0XWT3ki0rYEcltH2A8RlZgt6lrCxIs0puUqLfECMANGB07Jh8h
zkvsg+FpF3UQoiATXayCoT+hohdSbOLREm4AoS+LggqWEQkBsXypCl8ISEgNKZMw
58yIp0iHUoQ=
=f92N
-----END PGP SIGNATURE-----

 Quale client SSH2 con Windows conviene usare ed è il + sicuro?
Mi associo anche io nel consigliarti PuTTY. Ovviamente mi riferisco a una
versione almeno pari alla 0.53b, come ti ricorda giustamente anche Mario
Benvenuti. 
Puoi perfino scaricare i sorgenti e ricompilarteli da solo (ci sono anche
i binari, comunque). 
-- 
Carlo Luciano
GPG ElG/DSA 4096/1024 Key: 
http://web.tiscali.it/clbianco/clbianco.asc
ID: 0x5324A0DA - Fingerprint: 8B00C61034120506111B143DEDBF71B45324A0DA