Subject: Using SSH-GW

From: "Luis Fernando Barrera" <[email-masked]>
Date: Thu, 14 Sep 2000 13:29:02 -0600

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi,

I'd like to let external users to telnet to some internal
hosts in my network... TIS FWTK provides the "tn-gw" to do this,
however I know telnet sends everything in clear text, so 
it is not such a good idea...

I also know that there is a way someone can encrypt all the
comunications between some external client and the firewall. Then
the firewall forwards the request to some internal host unencrypted...

Since I'm a totally newbie to ssh, I don't have a clue to setup
such an enviroment. I mean... to encryt the comunication
between the firewall and the external clients (the comunication
between the firewall and internal hosts does not have to be encrypted).

I saw the patch to enables this, but it is very confussing...

Any ideas how to start?

Thanks you all in advance.

Luis Fernando Barrera
[email-masked]

---

From: Michel Bardiaux <[email-masked]>
Date: Fri, 15 Sep 2000 10:28:42 +0200

> it is not such a good idea...
Quite right.

 > the firewall forwards the request to some internal host unencrypted...
IMHO this is to be avoided. If your FW is compromised, the cracker would
have access to the cleartext of all traffic. On our FW we just tunnel
SSH to an internal host running the SSHD, using plug-gw. Pros: see the
ssh-gw README. In our case, we really wanted X11, IMAP, RSYNC and SMB
over SSH, and we did not feel we required more authentication than the
SSH private keys, and we *really* trust the external users, so ssh-gw
simply was not an option. Cons: anyone?

 > between the firewall and internal hosts does not have to be encrypted).
As I said above, the traffic 'inside' the FW, so to speak, also has to
be considered. 

 > I saw the patch to enables this, but it is very confussing...

What OS and SSH version do you intend to use on clients, FW and/or
internal host?

 > Thanks you all in advance.

Cheers
-- 
Michel Bardiaux
Peaktime Belgium S.A.  Rue Margot, 37  B-1457 Nil St Vincent
Tel : +32 10 65.44.15  Fax : +32 10 65.44.10

---

From: "Luis Fernando Barrera" <[email-masked]>
Date: Mon, 18 Sep 2000 10:27:35 -0600

Thanks for you response...
> As I said above, the traffic 'inside' the FW, so to speak, also has to

I know... This should be considered in the near future, since there's a lot
of traffice to be encripted... Windows 95/98, Mcintosh, Windows NT/2000,
RS/6000, etc... It's almost impossible (I think) to encrypt all this kind of
traffic..

> What OS and SSH version do you intend to use on clients, FW and/or
The OS of the Firewall is RedHat 6.2 and the clients would be Windows machines... (I already
got a ssh client for windows).

It seems harder to encrypt only the traffic between the firewall and the clients (i.e. using ssh-gw), than
encrypt the traffice between the clients and the target host (i.e. using plug-gw)? 

Have you used the ssh-gw? I've read the README file, but it's kind of confussing...I mean...
do you have to set up the ssh server in the firewall? Or just install the ssh-gw?

Thanks again...

Luis Fernando Barrera
[email-masked]