Overview

The GSW Secure Shell (SSH2) Server provides Secure Remote Access to your Windows Host including Secure Remote Logon, Data Exchange, and Access to you Application on an Insecure Network

Thank you for purchasing the Georgia SoftWorks (GSW) SSH2 Server for Windows NT/XP/VISTA/2000/2003. The GSW SSH2 Server provides unparalleled performance and includes the powerful features needed to achieve operational objectives in demanding commercial and industrial environments. The growing concern that sensitive data must not be available to unauthorized third parties demands that a client can securely access the remote server. This is especially important for RF access to a server.

Strong “End to End” encryption is employed with the GSW SSH2 Server. No clear text username and passwords are transmitted across the network. No clear text application data is transmitted across the network. All the data is encrypted using the strongest encryption available to provide complete confidentiality.

A Federal Information Processing Standards Publication (FIPS) 140-2 compliant option is available and may be purchased for the GSW SSH2 Server. This standard specifies the security requirements that will be satisfied by a cryptographic module utilized within a security system protecting sensitive or valuable data. This option is available to Federal agencies, including the US Military. The option is also available for purchase by other organizations such as state governments, educational and research institutions, commercial businesses and other entities with the need or desire to comply with this security requirement for cryptographic modules standard.

The GSW SSH2 Server is useful in a wide variety of environments that require Secure Remote Access and Strong Encryption that include:

· RF Application, Barcode Scanner, etc. (Warehousing, Inventory, Medical, etc.)

· SAP AG’s SAPConsole

· Application Service Providers (ASP)

· System Administration

· Legacy Applications

· Software Development and more!

The GSW SSH2 provides SSH2 (SSH version 2) operation rather than the older iteration SSH1 (SSH version 1) operation. In addition to being faster, smaller and more flexible, SSH2 provides significant security improvements. Even though SSH1 implementations exist, they are becoming fewer and are usually not recommended as a choice. GSW has chosen to provide the strongest, fastest and version of SSH – SSH2.

An extremely important aspect of the GSW SSH2 Server is the ease of installation. Complex and lengthy security configuration has been either eliminated or reduced to a minimum in order to get your application up and running fast without forsaking performance or compromising desired security. You do not have the administrative complexity of public/private keys and certificates when using the GSW SSH2 Server default settings.

Secure Remote Login, Secure Access to the Application and ensuring Data Integrity are the primary areas for concern when securing an application and the GSW SSH2 Server is optimized to address these needs.

Secure Remote Login

The GSW SSH2 server only allows connections from SSH2 clients. This ensures that all user data is encrypted prior to leaving the local client device. The data is decrypted at the remote GSW SSH2 Server. This includes authentication data such as the username and password that is required to Login to the remote server. The encryption is transparent, and thus the user will not perceive much, if any, variance between operation of a telnet and SSH2 client.

The SSH2 connection ensures that the Login and Authentication data is encrypted so that a malicious party can not intercept the sensitive information.

Secure Access to Your Application (Secure Data Exchange)

Since the connection between the SSH2 client and the GSW SSH Server is encrypted, the data transmitted is not readable by unauthorized parties. When the User is authenticated, a shell is started (cmd.exe), where the user can perform remote command execution or start applications. All data transmitted between the client and the server is encrypted. No one can “snoop” the connection and intercept clear text data because none exists!

Data Integrity

Data Integrity is essential for secure data exchange. The data received must be exactly the same as the data sent; otherwise an unauthorized party may have modified the data during the transmission. The SSH2 Transport layer ensures that the data received has not been modified from the data sent. This is accomplished by including a message authentication code (MAC) with each packet transmitted. The MAC is determined prior to encryption using the contents of the packet, a “Shared Secret” between the SSH2 client and SSH2 server and a packet sequence number.

Ease of Use

Many of the complex and lengthy configurations issues are automatically defined by the GSW SSH2 Server. It has been observed that an overwhelming majority of customers do not need nor desire to set every possible option available for SSH2 Security.

Most customers want the strongest security that is practical to implement. Through much dialog with our resellers and customers that use RF environments a main theme emerged. The requirement to “Keep it secure – simply” was paramount.

The installation of the GSW SSH2 Server is very quick. You will have users connecting with the security of powerful SSH2 encryption much sooner than expected.

· No Encryption Method has to be specified.

Many environments must ensure that the Windows Username and Password are encrypted as well as the data. GSW SSH2 Server provides complete confidentiality by defaulting to a very strong encryption method.

The GSW SSH2 Server defaults to AES-256.

AES-256 is the generally accepted strongest encryption standard offered by SSH2 – it is the Advanced Encryption Standard using a 256 bits cryptographic key. This is also known as the Rijndael algorithm which is a symmetric block cipher capable of using cipher keys that have 128, 192 and 256 bit lengths to process data blocks of 128 bits.

The GSW SSH2 server can be configured to refuse a connection if the SSH2 client can not operate with AES-256. Weaker encryptions only compromise the security of the connection so only the strongest encryption can be configured to ensure the strongest protection - while maintaining exceptional performance. AES-256 encryption is available on almost all SSH2 clients. Of course other encryptions are supported such as 3DES and Blowfish. The GSW SSH2 server will negotiate with the client to agree on the algorithm unless configured otherwise.

· No manual installation of certificates needed

Additionally it has been identified that the administrative requirements for public and private certificate installation is not needed or desired. In fact, the installation of certificates on RF devices would be complex and cumbersome at best. No public/private key generation or administration is required.

Component Architecture

The GSW SSH2 is composed of:

§ The GSW Universal Terminal Server (UTS)

§ The GSW SSH2 Shield

The GSW UTS is the software module that contains the core software for the GSW Server products, and the majority of the Advanced Features for the GSW Server Products

Figure 1: GSW Server Products Block Diagram

The GSW UTS standard option for the Protocol and Interface is the Telnet Interface. This configuration is marketed and sold as the GSW Telnet Server.

Figure 2: GSW Telnet Server Block Diagram

The GSW UTS SSH2 interface is installed by applying the GSW SSH2 Shield to the GSW UTS. The GSW SSH2 Shield disconnects the Telnet Protocol Interface and installs the SSH2 Interface.

This configuration is marketed and sold as the GSW SSH2 Server

Figure 3: GSW SSH2 Server Block Diagram

Installation

Overview

When you purchased the GSW SSH2 Server you either:

Own a GSW Telnet Server and are upgrading to the SSH2 Server

Are new customer purchasing the GSW SSH2 Server[1].

If you own a GSW Telnet Server and are upgrading to the SSH2 Server then:

You must have GSW Telnet Server Version 6.50 or higher installed. This is required to obtain the GSW UTS. Even though you are installing the GSW Telnet Server, the Telnet Interface becomes disabled when the SSH2 Shield is installed. If you have an older version then you will need to upgrade to the Version 6.50 or higher before you can apply the SSH2 Shield.
You next install the GSW SSH2 Shield
Register the GSW SSH2 Server.

If you are purchasing a new GSW SSH2 Server then:

You will receive the current version of the GSW Telnet Server. Install the GSW Telnet Server according to the Installation Instruction in the GSW UTS User Manual. You do not need to register the Telnet Server at this time. Registration takes place after the installation of the GSW SSH2 Shield.
You next install the GSW SSH2 Shield
Register the GSW SSH2 Server.

NOTE: The GSW SSH2 Server requires registration. The registration for the GSW UTS is not sufficient for the GSW SSH2 Server.

Procedure

Installation of the GSW SSH2 Server software is simple and quick. From Windows NT/XP/VISTA/2000/2003 perform the following:

1. Run the setup.exe program. The Welcome screen of the setup program is displayed and you are reminded and urged to exit all windows programs before continuing. You are also reminded that you must have administrative privileges to install this program. Click Next.

Figure 4: Installation Welcome Screen

1. A screen is displayed indicating the folder where the GSW SSH2 Shield will be installed. The default is:

C:\Program Files\Georgia SoftWorks\Georgia SoftWorks SSH2 SHIELD.

You may change the installation directory at this time. Note: Make sure that the users of the SSH2 Server have full access to the installation directory.

Figure 5: Installation – Choose Destination Folder

Select the Program Folder for the SSH2 Server. Click Next.

2. A shell opens a window with installation status lines similar to the figure below.

Figure 6: Installation – Command Shell Status Lines

3. Now the Setup is complete! Click Finish and Now its time to register the SSH2 Server!

Figure 7: Installation Complete

Please view the readme.txt file as it may contain late breaking information about the SSH2 Server that has not yet made it into the User Manual. Release notes are also contained in the readme.txt file.

Figure 8: GSW UTS Program Group

Installation will result in the Georgia SoftWorks program group item “Installation Status” showing GSW SSH2 as installed. Additionally the version of the GSW SSH Shield is displayed along with the status of the server and other Georgia SoftWorks software that may be installed.

Figure 9: SSH2 Installation Status

Registration

The GSW SSH2 Server is licensed for a single server. The license must be activated for the software to operate. To activate the license a valid Serial Number is required and is examined periodically by the SSH2 Server software. The Serial Number also allows new versions to be downloaded and installed for the duration of your subscription plan.

Two methods exist to obtain a valid Serial Number.

Registration via Floating License (default method)

The Serial Number is pre-programmed into a specific hardware key that came with your purchase. The hardware key connects to a parallel or USB port on the server. See page 11 for details on registration via the Floating License.

Registration via Software Serial Number.

This method exists for environments that do not support Parallel or USB ports. In brief this entails providing GSW with a machine specific Product ID. A Serial Number is generated based on the Product ID. This is usually performed via email, fax or telephone. See page 18 for details on Software registration.

Floating License – Overview

The Georgia SoftWorks Floating License provides the flexibility to rapidly move the GSW SSH2 Server from one machine to another. If you are unable to use the Floating License - skip this section and go to the section on Registration via Software Serial Number on page 18.

NOTE: When a SSH2 Server Pack is purchased (SSH2 Server and GSW Telnet Server), the same physical Floating License will contain valid Serial Numbers for both products.

With the Floating License NO software registration is required for the SSH2 Server to operate.

Common scenarios where the Floating License is useful include:

· Laboratory usage in a development or test environment where the SSH2 Server is required for short periods of time on any particular machine and then moved to a new machine.

· Backup Servers in a production environment. Typically multiple SSH2 Servers are purchased for backup systems, however with a Floating License the Hardware Key can be quickly moved from the primary machine to the backup without any other registration requirements.

· Environments where a failed server must be replaced or rebuilt and immediately restored to operation with full SSH2 Server capability.

The Georgia SoftWorks Floating License is a hardware key that connects to a female parallel port connector or USB Port on the server. The parallel port Floating License does not impact functionality of the port for other uses. The parallel hardware key acts as a pass-through allowing normal connections to the other side of the key.

The Georgia SoftWorks Floating License is a hardware key that can be ordered for a Parallel or USB Port.

Parallel Port Floating License

USB Floating License

Figure 10: Floating License – Parallel Port

The Parallel Port Floating License is a Pass Through allowing normal function of the port.

Figure 11: Floating License - USB Port

Not attached to a Server

The Parallel Port Floating License connects to a female parallel port on the server and does not impact functionality of the port for other uses. It acts as a pass though allowing normal connections to the other side of the key.

USB LED Lights when Installed

Figure 12: Floating License - Hardware Key

The SSH2 Server will recognize the presence of the key and activate the software with the proper date for which free version upgrades can be obtained. It does not matter which parallel or USB port on the server the Hardware Key is installed, as all ports will be scanned for the installation of the key.

The Floating License currently is installed using the manufacturer (Aladdin) of the hardware key’s setup program. It is described below. The name of the hardware key is HASPHL and you will see it displayed in the setup screens.

Floating License – Hardware Key Installation Instructions

1. Plug the hardware key onto the parallel or USB port on the server.

Note: If you are using a USB Floating License on a Windows NT system run the file aksnt4usb.exe prior to the following steps.

2. Copy the files from the Floating License folder(hardkey) on the provided CD to the hard drive on your sever.

3. Run the HASPUserSetup.exe program and follow the installation instructions. (After installation of the hardware key install the SSH2 Server as described on page 6.)

You will first see the Aladdin Splash Screen. The Aladdin Splash Screen will display for about 5 seconds.

Figure 13: Floating License - Installation Splash Screen

4. The next screen displayed is the Aladdin Welcome Screen.

Figure 14: Floating License – HW Key Initial Installation Welcome Screen

As the dialog indicates, if you have any running application please close them now.

Click Next

Figure 15: Floating License - License Agreement

Read the license agreement and select “I accept the license agreement”, and then Click Install.

Figure 16: Floating License - Accept License Agreement

5. An installation status progress meter is quickly displayed.

Figure 17: Floating License - HW Key - Installation Status

6. When the installation of the Aladdin Hasp Device driver is complete the screen below is displayed. Click Finish.

Figure 18: Floating License Drivers Successful Installation

7. Plug the hardware key onto the parallel or USB port on the server.

NOTE: On some systems you may have to reboot the server after installation. If the Floating License is not recognized (by the GSW SSH2) after installing the driver, please reboot the server.

Removing Floating License – (Hardware Key)

In the event that you need to remove the Floating License (Aladdin HaspHL) please use the Windows Control Panel Add/Remove Programs administrative utilities.

NOTE: Removing the Floating License will disable the SSH2 Server.

Registration via Software Serial Number

To run the GSW SSH2 Server you must first register the software. (This registration is NOT required if you installed the Floating License, Page 11) Registration via Software Serial Number entails just a few steps that involve obtaining the Product ID and providing this Identification to Georgia SoftWorks so a Serial Number can be generated. Georgia SoftWorks will provide you with the Serial Number based on the Product ID. When you enter the Serial Number into the Registration Tool, click Register.

NOTE: Read System Signature chapter at the end of manual (page 53).

How to Register the Software

To run the registration software -

· Select the Start button on the task bar; select Programs, then Georgia SoftWorks UTS Server and then Registration.

Prior to registering the SSH2 Server, a reminder dialog is presented indicating that the SSH Shield is not registered.

Figure 19: Registration – SSH Shield is not registered for use

The GSW SSH2 Server will be fully functional for a Trial Period of 30 days without requiring registering when installed for the first time on a system. Click OK

IMPORTANT NOTE: If you already own a GSW Telnet Server and you want to run a 30 day trial of the GSW SSH2 Server then you will need to request a 30 day trial serial number from Georgia SoftWorks. Please save a copy of the current SERIAL NUMBER for your telnet server prior to installing a 30 trial GSW SSH2 Server. In the event that you do not purchase the GSW SSH2 Server prior to the expiration of the trial you will need to apply your original serial number to re-activate the original GSW Telnet Server.
Next, the registration screen is displayed. The Registration program automatically fills in the Product Information fields as shown in the figure below. Complete the Customer Information fields as shown in the figure below.

Note: The Product Information Name and Version must contain valid data or it will not generate a correct Product ID.

Figure 20: GSW Registration - Initial Screen

Note that the Customer Information and Serial Number in the Registration Information may be already filled. This will be the case if the GSW UTS has previously been registered and operating as the GSW Telnet Server.

1. Please complete the Customer Information , Purchased From and the Application software fields in the Registration Screen.

2. The registration information must be provided to Georgia SoftWorks to obtain the Serial Number. Several methods are available for your convenience.

1. Save the information to a file and email it to Georgia SoftWorks - Preferred method.

Please save (using the Save to file button on the registration screen) this information to a file and email to Georgia SoftWorks registration@georgiasoftworks.com

Georgia SoftWorks SSH2 Server