Very Computer

by **Thomas W** » Thu, 22 Feb 2001 21:21:39

A recent mailing-list discussion prompted me to notice that the
default Telnet client and server distributed with various Linux
distributions like RedHat have fallen far behind the state-of-the-art
Open Source Telnet codebases out there, especially as far as
security is concerned. Features that have been added include:

- Strong authentication: SRP, Kerberos V5/V4
- Encryption: 3DES, CAST-128, DES
- X11 session forwarding
- SSL/TLS-based session security (confidentiality and integrity)

Some of the enhancements provide security features not present in
existing remote access products, like ssh, and users should be allowed
a free choice in the matter. Are crypto export restrictions still an
issue for Linux distros these days? What's the best way to proceed
with integrating a few years' worth of security work into existing
Linux codebases? I'd be willing to spend some time on the project
to see it through to completion.
--

Phone: (650) 723-1565 exchange for security deserve neither."
http://www-cs-students.stanford.edu/~tjw/ http://srp.stanford.edu/srp/

by **Frank da Cr** » Thu, 22 Feb 2001 23:44:23

:
: A recent mailing-list discussion prompted me to notice that the
: default Telnet client and server distributed with various Linux
: distributions like RedHat have fallen far behind the state-of-the-art
: Open Source Telnet codebases out there, especially as far as
: security is concerned. Features that have been added include:
:
: - Strong authentication: SRP, Kerberos V5/V4
: - Encryption: 3DES, CAST-128, DES
: - X11 session forwarding
: - SSL/TLS-based session security (confidentiality and integrity)
:
: Some of the enhancements provide security features not present in
: existing remote access products, like ssh, and users should be allowed
: a free choice in the matter.
:
Secure Telnet servers are listed here:

http://www.columbia.edu/kermit/telnetd.html

Various secure Telnet clients exist, most of them modifications of the
regular UNIX Telnet client, adding one of the security methods.
C-Kermit 7.0, however, implements all of the ones that Tom listed:

http://www.columbia.edu/kermit/ckermit.html

and adds file transfer, scripting, and character-set translation. Its
license allows inclusion with Linux:

ftp://kermit.columbia.edu/kermit/f/COPYING.TXT

: Are crypto export restrictions still an
: issue for Linux distros these days?
:
Binaries are restricted. There is also a USA embargo on a list of
specific countries, but apparently it does not extend to making
source code available in public venues.

- Frank

Very Computer

Folding Telnet enhancements into Linux distros

Folding Telnet enhancements into Linux distros

Folding Telnet enhancements into Linux distros