(Is there) Life After Telnet?

All-in-one version

(Regular [individual slides] version)

Pat Murphy
Ruth Milner

Overview

What are we doing? Blocking incoming telnet at routers (also incoming rlogin, rsh, rcp)
Why? Security Policy, good practice, encrypt datastreams
Can I still use telnet? Where?
How do I use ssh, SecureCRT, Putty?
Wrapping it all up

What We're Doing

INBOUND telnet stopped
OUTBOUND telnet DANGEROUS!
No SSH changes[1]
SITE to SITE: no change[2].
Original telnet deprecation was on July 1, 2002.

NOTE [1]: As of August 2008, ssh from outside is only permitted to the three login servers: login.site.nrao.edu where site is one of cv, gb, or aoc. NOTE [2]: Within a year from the presentation date, all telnet daemons were disabled on all NRAO computers.

What We're Doing

INBOUND telnet stopped
OUTBOUND telnet DANGEROUS!
No SSH changes[1]
SITE to SITE: no change[2].
Original telnet deprecation was on July 1, 2002.

What We're Doing

INBOUND telnet stopped
OUTBOUND telnet DANGEROUS!
No SSH changes[1]
SITE to SITE: no change[2].
Original telnet deprecation was on July 1, 2002.

Where can I still use TELNET

First: Please DON'T! SSH really is better.
Internally: NO blocks between NRAO sites or machines
Outgoing: FROM NRAO to other sites (if you can; as of 2002 NOAO, STScI, Jodrell, Chandra, Caltech won't let telnet in; as of 2008 almost nobody runs telnet services; it's dead, Jim.)
Again: SSH is better (Encrypted, X tunneling, DISPLAY pre-set for you, Compression...)

Why are we doing this?

Comply with our own Security Policy
Being cracked (intruded) by others takes TIME: AIPS++ down for a week, Bonn months.
Trivial to grab telnet passwords. READ THIS!
"The Internet is a Hostile Place".
We can't afford NOT to!

How to use SSH

Unix: See The Gold Book SSH page and The Gold Book SCP page
Windows:
- (some) NRAO systems: SecureCRT (we install it)
- Other systems (and strongly recommended): PuTTY (free software) for home, colleagues, etc.

Mac: OSX (which is Unix!) 10.1 and later support OpenSSH
Web interface: MindTerm

Conclusions

Incoming telnet, rlogin, rcp, rsh are dead! They are disabled practically everywhere!
We have alternatives, and have documented them.
Observatory-wide ongoing, continuing effort (with HowTo's.
This, other steps we take are relative; Security like a set of speed bumps.
Security is a process.

Pat Murphy