Subject: SecSH Server functionality on Windows - incomplete

From: Peter M Boyd <[email-masked]>
Date: Tue, 27 Nov 2001 16:03:04 +0000 (GMT)

As I understand it:

The goal of the Secure Shell working group is to
update and standardize the popular SSH protocol.

The working group will attempt to assure that the SSH
protocol

o provides strong security against cryptanalysis and
protocol attacks, 

o can work reasonably well without a global key
management or certificate infrastructure, 

o can utilize existing certificate infrastructures
(e.g., DNSSEC, SPKI, X.509) when available, 

o can be made easy to deploy and take into use, 

o requires minimum or no manual interaction from
users, 

o is reasonably clean and simple to implement. 

The resulting protocol will operate over TCP/IP or
other reliable but insecure transport. It is intended
to be implemented at the application level. 

And yet as implemented in many, if not all, versions
on Windows, SecSH cannot support the full Windows
Shell capabilities.

Examples:

when using CMD.EXE as the Shell on Windows Servers,
the simple text editor EDLIN cannot be used via SecSH
to support its natural functionality that works in a
local DOS Window

browsing a file using 'pipe' into the 'more' function
doesn't work via SecSH yet it does, of course, work
locally

CTRL&C does not interrupt a long running function via
SecSH, which does work locally

Have Windows implementors not understood what SecSH
was intended to support?

It seems to me that SecSH is good to *N*X Servers, is
good as a tunnel between a Client program and a Server
program, e.g. used with VNC

    but not good to a Shell in Windows

---- even if a *N*X Shell is used in Windows instead
of CMD.EXE, the ablove deficiencies still apply

Is this of any concern to the IETF?

regards

Peter M Boyd 

__________________________________________________
Do You Yahoo!?
Everything you'll ever need on one web page from News and Sport to Email and Music Charts
http://uk.my.yahoo.com

---

From: Markus Friedl <[email-masked]>
Date: Tue, 27 Nov 2001 17:08:20 +0100

On Tue, Nov 27, 2001 at 04:03:04PM +0000, Peter M Boyd wrote:
> [..]

i don't see how this applies to the protocol. have you
checked that the protocol disallows CTRL-C on Windows? have
you checked your implementation for a bug?

it seems this is an implementation issue and not a protocol issue.

---

From: Rodney Thayer <[email-masked]>
Date: Tue, 27 Nov 2001 09:20:23 -0800

First, this is off topic for the IETF WG list.   In another
place, it'd be a fine and legitimate topic.  The WG list
is for the protocol, I believe.  Check the charter if you
disagree.

a 'shell server' on a Windows box is a stretch,
since that platform doesn't really support that paradigm.
it's about the same as a shell server on a macintosh
(e.g. no Redmond bashing required.)

However, scp to a Windows box, or equivalent, to update
a web site is tremendously more secure that something
done insecurely (e.g. "PC Anywhere" style functionality with
no security)

I can't fire up a command shell on one win2k box from another,
even if there's no security in the middle, so I don't think
this is ssh's problem.

---

From: Bill Sommerfeld <[email-masked]>
Date: Tue, 27 Nov 2001 14:58:21 -0500

> Is this of any concern to the IETF?

Peter,

It's a quality-of-implementation issue.

As others have pointed out, this is (as best as I can tell) not a
problem with the protocol specification, but a limitation of either
certain implementations of the SSH service on Microsoft OS's or of the
MS OS's themselves.  As such, it's out of scope for this working
group.

It sounds like you've pointed out a few bugs or missing features, and
I'd encourage any or all of the implementors for M$ OS's listening
here to take these to heart.  

On the other hand, if the implementors-for-M$ can identify specific
difficulties with the *wire protocol*, I'm all ears...

					- Bill
				Working Group chair, IETF SECSH WG

---

From: Jack Lloyd <[email-masked]>
Date: Tue, 27 Nov 2001 21:13:11 -0500 (EST)

> (e.g. no Redmond bashing required.)

Unless, of course, you're running MacOS X. ;)

Sorry, couldn't help myself... -J