HP-SSH Explained paper

[Chris Wong]

Version 1 of my HP-SSH Explained paper is now available at:
http://newfdawg.com/docs/HP-SSH_Explained.PDF
It is almost 3 MB.
This paper does not include installation & configuration, that can be found at:
http://newfdawg.com/SHP-Articles.htm

- Chris

[Steven E. Protter]

Get it here.
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=T1471AA

A good configuration paper is attached.

SEP

[Steven Sim Kok Leong]

Hi Chris,

I think this is a great article to help any HP-UX administrator new to SSH to pick up fast on both basic features as well as explore advanced features.

I read the download portion and realised that there was no mention of any checksums to be checked to authenticate the downloaded T1471AA. Subsequently performed a check on http://www.software.hp.com and true enough, there were no md5 checksums or gpg signatures for package verification of any of HP's packages.

If we look at most opensource programs like apache, openssl or openssh, there are md5 checksums and gpg signatures to check against trojan'ed packages.

The security threat is real because there had been past reports (by CERT/CC) of trojan'ed OpenSSH distributions (CA-2002-24) and Sendmail distributions (CA-2002-28).

Without http://www.software.hp.com on SSL and without any authenticode (md5 or gpg), it is a potentially big security risk that someone could compromise the server itself, or an internal DNS server or poison the DNS cache while creating a spoof'ed website to entrap a user into installing a trojan'ed package.

Have I missed any mitigating mechanisms implemented by HP?

Thanks in advance. Regards.

Steven Sim Kok Leong

[Chris Wong]

Hi,

Great point. I guess the answer is "you can install it from the application CD". Let's see if someone from HP responds to this. I believe the same situation applies to any HP-UX software downloaded from software.hp.com.

- Chris