Date: Thu, 7 Dec 1995 22:55:41 -0500
From: Charles Hannum <Charles-Hannum@deshaw.com>
Message-Id: <199512080355.WAA02272@cs1.boston.deshaw.com>
To: netbsd-developers@netbsd.org
Subject: Please try ssh ASAP!
Sender: owner-netbsd-developers@NetBSD.ORG
Precedence: first-class


I strongly urge everyone on this list to try out ssh.  The latest
version of it can be found on pain, in ~mycroft/ssh-1.2.12.tar.gz.
Instructions on how to set it up are below.

Among the features of ssh:

* strong encryption
* cryptographic authentication
* works through most firewalls
* does compression much better than CVS
* can forward X (and other) connections securely

To use it:

1) Unpack it, run `./configure && make', and install it.

2) In /etc/ssh_config, turn off FallBackToRsh and turn on
StrictHostKeyChecking.  (This is paranoia, so you don't accidentally
do something insecure.)

3) If you're using a slow connection, in either /etc/ssh_config or
~/.ssh/config, set CompressionLevel to `1' and Compress to `yes'.
(You can do this per target host.)  Please do *NOT* use a
CompressionLevel higher than 3, as this will put a significant load on
pain, and it won't do much for you anyway.

4) Run `ssh-keygen' on your machine to make yourself a key pair.

5) Put a copy of your ~/.ssh/identity.pub in ~/.ssh/authorized_keys on
pain.

6) Make sure you're running a recent version of CVS.

7) Set CVS_RSH to `ssh', and run cvs like you normally would.

8) If you decide to run a sshd, in /etc/sshd_config, turn off at least
RhostsAuthentication.

(Since the initial exchange of public keys is done insecurely, this
process is obviously susceptible to a man-in-the-middle attack at that
point, but we'll ignore that for now.)