Table of Contents
Secure Shell Client Features and Requirements
There are many benefits to using a secure shell client. On top of the encryption of
the data transfer and secure key exchange, the SSH protocol also offers verification
that you are connected to the correct computer.
This may seem surprising, but it makes perfect sense. Keep
in mind that if somebody were able to control any part of the communication path,
they could actually reroute the traffic to another computer. This can then play
the role of the computer which you actually wanted to connect to, and could either
display fake data or obtain information from the client computer - both of which
could be equally damaging. When you use a secure shell client, you don't need to
worry about these kinds of scenarios.
A SSH client should also support different authentication methods.
These include username/password, public/private key, and various custom formats. The
latter might include a system where the server could obtain information that only
the authorized users know, e.g. by using a hardware ID card or by sending an access
code to the user's mobile phone.
A good secure shell client needs to be able to connect to various different servers.
In order to do this, it has to support latest key exchange and encryption
protocols, because what seemed unbreakable five years ago, is considered less
so today. If the server switches to more advanced encryption methods, ssh
clients need to support these as well.
Other typical must have features for a ssh client would be:
- SFTP file transfer
- Port forwarding (tunneling connections from client to server through the ssh channel)
- PKCS#11 authentication (this allows authentication through hardware, e.g. smart cards)
- Dynamic port forwarding (SOCKS like)
- ED25519, ECDSA, RSA and DSA public key authentication
- X11 forwarding (allows to run x-windows programs on the remote server)
- UTF8 support in terminal emulation
- Connection through proxy
Technical SSH Essentials
The basis of the SSH protocol are laid out in IETF internet standard RFC 4253.
The document describes SSH as a secure transport that provides cryptographic
host, strong encryption, authentication, and integrity protection.
Or, as RFC 4253 states in its own words:
The Secure Shell (SSH) is a protocol for secure remote login and
other secure network services over an insecure network.
[...] The protocol can be used as a basis
for a number of secure network services. It provides strong
encryption, server authentication, and integrity protection.
It may also provide compression.
Key exchange method, public key algorithm, symmetric encryption
algorithm, message authentication algorithm, and hash algorithm are
all negotiated.
It hence defines ways to create a shared encryption key in the possible
presence of a listener, host and user authentication methods (i.e. ways
in which users and server can prove that they are who they claim to be),
and possible data compression to more effectively transmit data.
An especially challenging part of encrypting communication over public networs, is
the need to negotiation a shared secret (an encryptino key) over a channel that
might already be monitored by an adversary.
SSH answers this challenge through the initial key exchange phase
of the connection using the older Diffie-Hellman kex method. Never versions
now also support ED25519 elliptic curve kex. It is a specific implementation
of the Edwards-curve Digital Signature Algorithm (EdDSA), which itself is a variant
of Schnorr's signature system with Twisted Edwards curves (math heavy details
can be found
in the upcoming IETF standard for ED25519.
Good Terminal Emulator based on the SSH Protocol
However, SSH only covers the actual transmission of data between the
client and server. But the SSH client
is usually a terminal emulator,
i.e. a software that allows a remote computer to receive keyboard input
from, and send formatted text (color, cursor placement, etc.)
to the user's computer.
Obviously, the client still needs to be able to perform the
functions of a terminal - supporting various terminal emulations, printing, logging,
and so on. This is why ZOC is the ideal Secure Shell Client,
it does all of the above, and more.
