Georgia SoftWorks

SSH Server for Windows 10/8/7/VISTA/2008/2012/R2/2016

Keep it Secure – Simply

 

 

User’s Guide


THIS PAGE INTENTIONALLY LEFT BLANK
Georgia SoftWorks

SSH Server

 

 

 

 

Copyright ã 1997-2018, Georgia SoftWorks, All Rights Reserved

Public Square

17 Hwy 9 South • PO Box 729

Dawsonville Georgia 30534

Telephone 706.265.1018 • Fax 706.265.1020

http://www.georgiasoftworks.com


Copyright © Georgia SoftWorks, 1997-2018All Rights Reserved.

User's Manual, Version 8.09.0001, March 09, 2018

Microsoft, Windows, Windows VISTA, Windows XP, Windows 2000 Windows NT, Windows 98, Windows 95, Windows 7, Windows 8, Windows 10, Windows Server 2016,  Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2 , Windows Server 2008, Windows Server 2003 are trademarks of Microsoft Corporation. SAP, SAPConsole are trademarks of SAP AG.  SecureCRT, F-Secure, PuTTY, PuTTYgen are trademarks of their respective companies.

 

THIS PROGRAM IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

LICENSOR MAKES NO WARRANTIES OR REPRESENTATIONS, EXPRESS OR IMPLIED, ORAL OR WRITTEN, REGARDING THE PROGRAM OR DOCUMENTATION AND HEREBY EXPRESSLY DISCLAIMS ALL OTHER EXPRESS OR IMPLIED WARRANTIES, INCLUDING MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. LICENSOR DOES NOT WARRANT THE PROGRAM WILL MEET YOUR REQUIREMENTS OR THAT ITS OPERATION WILL BE UNINTERRUPTED OR ERROR FREE.

IN NO EVENT WILL GEORGIA SOFTWORKS BE LIABLE TO YOU FOR ANY DAMAGES, INCLUDING ANY LOST PROFITS, LOST SAVINGS OR OTHER INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE SUCH PROGRAMS.

COPYING:

WHILE YOU ARE PERMITTED TO MAKE BACKUP COPIES OF THE SOFTWARE FOR YOU OWN USE AND PROTECTION, YOU ARE NOT PERMITTED TO MAKE COPIES FOR THE USE OF ANYONE ELSE.

LICENSE:

YOU ARE LICENSED TO RUN THIS SOFTWARE ON A SINGLE WINDOWS 7/8/10/VISTA/2008/R2/2012/R2/2016, NT/XP/2000/2003 SYSTEM. THE GEORGIA SOFTWORKS WINDOWS 7/8/10/VISTA/2008/R2/2012/R22016, NT/XP/2000/2003 SSH SERVER SOFTWARE MAY BE INSTALLED ON A SINGLE WINDOWS 7/8/10/VISTA/2008/R2/2012/R2/2016, NT/XP/2000/2003 SYSTEM. 

 


This Page Left Intentionally Blank
Table of Contents


Features at a Glance.. 11

Overview... 14

Ease of Use.. 17

Component Architecture.. 18

Installation.. 20

Overview... 20

Procedure.. 21

Registration.. 25

Floating License – Overview... 25

Floating License – Hardware Key Installation Instructions. 27

Uninstall Floating License – (Hardware Key) 31

Registration via Software Serial Number.. 32

How to Register the Software. 32

GSW SSH Server.. 37

GSW FIPS 140-2 Compliant Option.. 39

Software Requirements. 39

Enable Option.. 40

ENABLE FIPS 140-2 ON SSH SERVER.. 40

ENABLE FIPS 140-2 ON GSW MOBILE/CE and DESKTOP CLIENTS. 41

FIPS 140-2 Connections. 43

Configuration.. 44

Registry Key Locations. 44

Allow user to use SCP channel.. 44

Allow user to start a remote Shell.. 45

Allow user to use SFTP subsystem... 46

Specify the SFTP Root Folder.. 46

Allow user certificate logon.. 47

Allow user public key logon.. 49

Allow User Name/Password logon.. 49

Allow user GSSAPI logon.. 50

Listen on IPv4 interfaces. 51

Listen on IPv6 interfaces. 51

Allow use of the “Exec” channel.. 52

Enable RSA Host Key.. 53

Enable DSA Host Key.. 54

Enable ECDSA Host Key.. 54

Encryption algorithm categories and lists overview... 56

Specify Key Exchange Algorithms. 57

Specify Ciphers. 58

Specify Message Authentication Code Algorithms (MACs) 59

Algorithm selection for GSW Desktop SSH Client.. 60

Host Key Algorithms List 60

Key Exchange Algorithm List 61

Ciphers List 62

Message Authentication Code (MACs) list 63

SSH Desktop Client Command line Syntax. 64

Change the SSH Port Number.. 65

Location of SSH Server RSA Private Key.. 66

Location of SSH Server DSA Private Key.. 67

Location of SSH Server ECDSA Private Key.. 68

Location of Fingerprints for all Host Keys. 69

SSH Server Mapping Tool for Certificates and Public Keys. 72

Certificate One-to-one mapping.. 73

Certificate Many-to-one mapping.. 73

Public Key 1-to-1 mapping.. 74

Certification Validation – Certificate Trust List.. 75

Public/Private Key Creation and Use.. 76

Public / Private Key Introduction.. 76

Creating a Public / Private Key.. 77

Install Public Key on the Server and Map to Windows User Account.. 80

Install and Configure Private Key on the Client.. 83

SSH Clients. 93

GSW SSH CLIENTS. 93

GSW DESKTOP CLIENT. 94

Windows Mobile Clients. 95

Windows Mobile. 95

Windows CE 4.2+ Devices. 97

Third Party SSH Clients. 100

Specify Domain with a 3rd Party Client 103

Registry Variables. 104

SSH Algorithms Support.. 106

Key Exchange Algorithms. 106

Host Key Algorithms. 106

Key exchange algorithms. 106

Ciphers. 107

Ciphers. 107

MACs. 108

Host Key Types. 108

Public Key Algorithms. 108

Compression.. 109

Compression.. 109

GSW SSH Server Subscription.. 111

HOW TO UPDATE THE SOFTWARE.. 112

HOW TO RENEW THE GSW Subscription.. 112

SSH Server Folder Layout.. 113

System Signature - IMPORTANT PLEASE READ.. 115

Technical Support.. 116

Provide Log Files To GSW Technical Support.. 116

 


Table of Figures

 

Figure 1: GSW Server Products Block Diagram... 18

Figure 2: GSW Telnet Server Block Diagram... 19

Figure 3: GSW SSH Server Block Diagram... 19

Figure 4: Installation Welcome Screen.. 21

Figure 5: Installation – Choose Destination Folder. 22

Figure 6: Installation – Command Shell Status Lines. 23

Figure 7: Installation Complete. 23

Figure 8: GSW UTS Program Group.. 24

Figure 9: SSH Installation Status (Your version will be shown in the fields above) 24

Figure 10: Floating License – Parallel Port 26

Figure 11: Floating License - USB Port 26

Figure 12: Floating License - Hardware Key.. 26

Figure 13: User Account Control 27

Figure 14: SafeNet welcome screen - computing space requirements. 28

Figure 15: SafeNet welcome screen - second part 28

Figure 16: SafeNet License Agreement 29

Figure 17: SafeNet License Agreement - Read and Accept 29

Figure 18: SafeNet – Ready to Install 30

Figure 19: SafeNet Validating Install 30

Figure 20: SafeNet Successful Installation.. 31

Figure 21: Registration – SSH Shield is not registered for use. 32

Figure 22: GSW Registration - Initial Screen.. 33

Figure 23: Registration - Serial Number Applied.. 34

Figure 24: Registration Successful Screen.. 35

Figure 25: Registration Verification.. 35

Figure 26: Registration - Verify that FIPS 140-2 is Enabled.. 36

Figure 27 - GSW Software Installation Status Tool 37

Figure 28: Control Panel - GSW SSH Services Started.. 38

Figure 29: GSW True FIPS 140-2 Connection – Server and Client 40

Figure 30: FIPS 140-2 Option Enabled.. 40

Figure 31: Desktop Client "-i" option issued.. 41

Figure 32: Enable FIPS 140-2 on GSW Mobile Clients. 42

Figure 33: Verify FIPS 140-2 Compliant Connections. 43

Figure 34 - SSH Certificate Mapping Tool 72

Figure 35 - One-to-one certificate mapping. 73

Figure 36 - Many-to-one certificate mapping. 74

Figure 37 - Public Key Mappings - 1-to-1. 74

Figure 38 - Certificate Validation Certificate Trust List 75

Figure 39: Puttygen Tool for Creating Public/Private Key Pair. 77

Figure 40: Puttygen Tool Uses Mouse-Movement to Create Randomness for Key Creation.. 78

Figure 41: Puttygen with Generated Key.. 79

Figure 42: Certificate Mapping Tool 80

Figure 43: Mapping an Account to a Public Key.. 81

Figure 44: Certificate Mapping Tool – Public Key Mappings. 81

Figure 45: Certificate Mapping Tool Dialogue Box.. 82

Figure 46: Opening the Client on a Device to Set-up Public Key Log-on.. 83

Figure 47: Selecting a Connection profile. 84

Figure 48: Selecting Options on GSW SSH2 Client to Configure Public Key Log-on.. 85

Figure 49: Selecting Public Key Log-on.. 86

Figure 50: Configuring Public Key Log-on.. 87

Figure 51: Configuring the Client by Providing a Private Key.. 88

Figure 52: Browsing to Find Private Key.. 89

Figure 53: Private Key Imported into Client 90

Figure 54: Client Launch Using Public / Private Key Authentication.. 91

Figure 55: Session Connected via Public / Private Key Authentication.. 92

Figure 56: GSW SSH Desktop Client 94

Figure 57: GSW PPC 2003 Client 95

Figure 58: GSW PPC 2003 Client – Options. 96

Figure 59: GSW PPC 2003 Client - SAPConsole - SSH... 96

Figure 60: Psion-Teklogix Initial Screen.. 97

Figure 61: Psion-Teklogix – Session Menu Items. 97

Figure 62: Psion-Teklogix Connection Settings. 98

Figure 63: Psion-Teklogix – Save Settings. 98

Figure 64: Psion-Teklogix running SAP via SAPConsole. 99

Figure 65: Psion-Teklogix Save Client Settings Menu. 99

Figure 66: 3rd Party Client – SecureCRT – SAPConsole. 100

Figure 67: 3rd Party Client - PuTTY - Unicode. 101

Figure 68: 3rd Party Client - F-Secure SSH Client 102

Figure 69: Installation Folder Layout of the GSW UTS.. 113

Figure 70: Installation Folder Layout of the GSW SSH Shield.. 114

 

 

 

Table of Tables

 

Table 1: GSW Software versions required for FIPS 140-2. 39

Table 2: Device Operating System Versions Required for FIPS 140-2. 39

Table 3: GSW Desktop Host Key Algorithms. 60

Table 4: GSW Desktop Key Exchange Algorithms. 61

Table 5: GSW Desktop Ciphers - SSH and with FIPS 140-2. 62

Table 6: GSW Desktop MACs both SSH and FIPS 140-2. 63

Table 7: GSW SSH Client Platforms. 93

Table 8: SSH Host Key and Key Exchange Algorithms. 106

Table 9: SSH Ciphers. 107

Table 10: SSH HMACs. 108

Table 11: SSH Public Key Algorithms. 108

Table 12: SSH Compression.. 109

Table 13: FIPS 140-2 certificate links. 110

Table 14: Version Upgrade Pricing with GSW Subscription Plan.. 111

Table 15: Version Upgrade Pricing Without Subscription Plan.. 111

Table 16: Steps to Renew the GSW Subscription Plan.. 112



Typographic Conventions

 

Italics:                                         are used to emphasize certain words, especially new terms or phrases when they are introduced.

 

Initial Caps Bold:                     Words that appear in initial caps boldface represent menu options, buttons, icons or any object that you may click.

 

Courier:                                 This font represents anything you must type.

 

"<enter>"                                   This represents the enter key.

 

 

 

 Terms/Abbreviations

 

 

 

UTS                                            GSW Universal Terminal Server

 

SSH                                            Secure Shell Version 2

                                                   Always refers to SSH version 2 (SSHv2) except where noted

 

SSH SHIELD                            This is the application and interface installer for the GSW SSHv2 Interface

 

SSH SHIELD Certificate Mapping Tool

   This is the GSW GUI tool that is used when configuration and managing the   mapping of Digital Certificates, Public Keys and CTL’s.

Often called the GSW Mapping Tool or GSW Certificate Mapping Tool.

 

Telnet Server                              Unless noted otherwise this refers to the GSW UTS with the default Telnet Protocol

 

Windows                                    Refers to Microsoft Windows Operating Systems NT 4.0/XP/ VISTA/7/8/2000/2003/2008/R2/2012/R2/2016 unless otherwise noted.

 

 

 

 

Features at a Glance

Offering Secure Remote Logon, Secure Data Exchange, Secure Network Services and Secure Access to your Application on an Insecure Network.

Georgia SoftWorks SSH Server

·         Complete Data Stream Encryption

AES-256, 3DES, and other ciphers supported (see below)

·         Easy to Install and Use

Defaults provide strong encryption

                No Certificate provision required (However, available if you want it)

·         Automatic Generation and installation of RSA, DSA and ECDSA Host Keys

·         Host Fingerprints file holds key fingerprints for all host keys offered for server-to-client authentication.

·         FIPS 140-2 Compliant Option

·         IPv6 Support

·         Integrated with GSW UTS feature set including GUI Configuration Tool

·         Perfect Support for ALL PC Keys and International Characters

  • GSW SSH Clients for Windows Desktops, PPC 2003, Windows CE .Net 4.2+, Windows Mobile (WM5)+ class devices.

Elliptic Curve Cryptography Support for

·         Server-to-client authentication

·         Key Exchange

·         Public key authentication

  • Host Key types

·          ‘rsa-sha2-512’

·          ‘rsa-sha2-256’

·          ‘ecdsa-sha2-nistp521’

·          ‘ssh-rsa’

·          ‘ssh-dss’

  • Key Exchange algorithm

·          ‘curve25519-sha256@libssh.org’

·          ‘curve25519-sha256’

·          ‘diffie-hellman-group-exchange-sha256’

·          ‘diffie-hellman-group14-sha256’

·          ‘diffie-hellman-group16-sha512’

·          ‘diffie-hellman-group18-sha512’

·          ‘ecdh-sha2-nistp521’

·          ‘ecdh-sha2-nistp384’

·          ‘ecdh-sha2-nistp256’

·          ‘ext-info-c’

·          ‘diffie-hellman-group-exchange-sha1’

·          ‘diffie-hellman-group-14-sha1’

·          ‘diffie-hellman-group1-sha1’

  • HMAC algorithms

·          ‘hmac-sha2-512-etm@openssh.com’

·         ‘hmac-sha2-256-etm@openssh.com’

·         ‘hmac-sha2-512’

·         ‘hmac-sha2-256’

·         ‘hmac-sha1’

·         ‘hmac-sha1-96’

·         ‘hmac-md5’

·         ‘hmac-sha1-etm@openssh.com’

·          ‘chacha20-poly1305@openssh.com’

·          ‘aes256-gcm@openssh.com’

·          ‘aes128-gcm@openssh.com’

·          ‘aes256-ctr[1]

·          ‘aes128-ctr[2]

·          ‘aes192-ctr[3]

·          ‘3des-ctr4

·          ‘aes256-cbc’

·          ‘aes192-cbc’

·          ‘aes128-cbc’

·          ‘3des-cbc’

·          ‘blowfish-cbc’

·          ‘rijndael256-cbc’

·          ‘rijndael192-cbc’

·          ‘Rijndael128-cbc’

·          ‘rijndael-cbc@lysator.liu.se’

·          ‘cast128-cbc’

 

 

Plus GSW Digital Certificate Based Authentication

 

  • Public Key Authentication with Microsoft IIS like certificate to user account mapping
  • ‘One-to-one’ and ‘Many-to-one’ mapping methods that also support supports certificate trust lists (CTL).
  • Certificate mapping tool also supports public key to user account mapping
  • Single Sign On through NTLM and Keberos over GSSAPI (‘gssapi-with-mic’)
  • Certificate based authentication through:

·         ‘x509v3-sign-rsa’ and ‘x509-sign-dss’ public key authentication standards

·         Integrated with the Microsoft Certificate Stores

 


 

Overview

The GSW Secure Shell (SSH) Server provides Secure Remote Access to your Windows Host including Secure Remote Logon, Data Exchange, and Access to your Application on an Insecure Network

Thank you for purchasing the Georgia SoftWorks (GSW) SSH Server for Windows 7/8/VISTA/2008/R2/2012/2016, NT/XP/2000/2003. The GSW SSH Server provides unparalleled performance and includes the powerful features needed to achieve operational objectives in demanding commercial and industrial environments. The growing concern that sensitive data must not be available to unauthorized third parties demands that a client can securely access the remote server. This is especially important for RF access to a server.

Strong “End-to-End” encryption is employed with the GSW SSH Server.  No clear text username and passwords are transmitted across the network.  No clear text application data is transmitted across the network. All the data is encrypted using the strongest encryption available to provide complete confidentiality. 

A Federal Information Processing Standards Publication (FIPS) 140-2 compliant option is available and may be purchased for the GSW SSH Server.  This standard specifies the security requirements that will be satisfied by a cryptographic module utilized within a security system protecting sensitive or valuable data. This option is available to Federal agencies, including the US Military. The option is also available for purchase by other organizations such as state governments, educational and research institutions, commercial businesses and other entities with the need or desire to comply with this security requirement for cryptographic modules standard.

The GSW SSH Server is useful in a wide variety of environments that require Secure Remote Access and Strong Encryption that include:

·                     RF Application, Barcode Scanner, etc. (Warehousing, Inventory, Medical, etc.)

·                     SAP AG’s SAPConsole

·                     HighJump, QAD and more

·                     Application Service Providers (ASP), Legacy Applications

·                     System Administration, Software Development and more!

·                     The GSW Business Tunnel is an excellent client application for the GSW SSH Server providing secure web browsing, email access, RDP and much more.

The GSW SSH provides SSH (SSH version 2) operation rather than the older iteration SSH1 (SSH version 1) operation. In addition to being faster, smaller and more flexible, SSH provides significant security improvements. Even though SSH1 implementations exist, they are becoming fewer and are usually not recommended. GSW has chosen to provide the strongest, fastest and version of SSH – SSHv2.

 

An extremely important aspect of the GSW SSH Server is the ease of installation. Complex and lengthy security configuration has been either eliminated or reduced to a minimum in order to get your application up and running fast without forsaking performance or compromising desired security. You do not have the administrative complexity of public/private keys and certificates when using the GSW SSH Server default settings.

 

Secure Remote Login, Secure Access to the Application and ensuring Data Integrity are the primary areas for concern when securing an application and the GSW SSH Server is optimized to address these needs.

 

Strong Authentication

The GSW SSH Server offers the Strongest Authentication features available for Windows.

In addition to User Name/Password Authentication, the GSW SSH Server for Windows offers Public Key Authentication with a GUI Internet Information Server (IIS) like certificate to user account mapping. This includes ‘One-to-one’ and ‘Many-to-one’ mapping methods and also supports certificate trusts lists (CTL). This mapping works with all user accounts including accounts defined in the Active Directory. Additionally the GSW GUI mapping tool allows public key to user account mapping.

To learn more about GSW Digital Certificate Based Authentication, please visit the GSW website:

http://www.georgiasoftworks.com/products/ssh2/ssh_authentication_x509v3.php

 

Secure Remote Login

The GSW SSH Server only allows connections from SSH clients.  This ensures that all user data is encrypted prior to leaving the local client device. The data is decrypted at the remote GSW SSH Server. This includes authentication data such as the username and password that is required to login to the remote server. The encryption is transparent, and thus the user will not perceive much, if any, variance between operation of a telnet and SSH client.

The SSH connection ensures that the Login and Authentication data is encrypted so that a malicious party cannot intercept the sensitive information.


 

Secure Access to Your Application (Secure Data Exchange)

Since the connection between the SSH client and the GSW SSH Server is encrypted, the data transmitted is not readable by unauthorized parties.  When the User is authenticated, a shell is started (cmd.exe), where the user can perform remote command execution or start applications. All data transmitted between the client and the server is encrypted. No one can “snoop” the connection and intercept clear text data because none exists!

Data Integrity

Data Integrity is essential for secure data exchange.  The data received must be exactly the same as the data sent; otherwise an unauthorized party may have modified the data during the transmission. The SSH Transport layer ensures that the data received has not been modified from the data sent. This is accomplished by including a message authentication code (MAC) with each packet transmitted. The MAC is determined prior to encryption using the contents of the packet, a “Shared Secret” between the SSH client and SSH server and a packet sequence number.

 


Ease of Use

                       

Many of the complex and lengthy configurations issues are automatically defined by the GSW SSH Server. It has been observed that an overwhelming majority of customers do not need nor desire to set every possible option available for SSH Security. 

 

Most customers want the strongest security that is practical to implement. Through much dialog with our resellers and customers who use RF environments a main theme emerged. The requirement to “Keep it secure – simply” was paramount.

 

The installation of the GSW SSH Server is very quick. You will have users connecting with the security of powerful SSH encryption much sooner than expected.

 

·                     No Encryption Method has to be specified.

Many environments must ensure that the Windows Username and Password are encrypted as well as the data. GSW SSH Server provides complete confidentiality by defaulting to a very strong encryption method.

 

The GSW SSH Server defaults to the following:

 

Host Key Algorithms: rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp521,ssh-rsa,

ssh-dss

 

KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1

 

Ciphers: aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes192-ctr,3des-cbc,aes128-ctr,aes128-gcm@openssh.com,aes256-cbc,rijndael256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,rijndael192-cbc,aes128-cbc,rijndael128-cbc,cast128-cbc,blowfish-cbc

 

MACs: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1-etm@openssh.com,hmac-sha1,hmac-sha1-96,hmac-md5,none

 

Public Key Algorithms: rsa-sha2-512, rsa-sha2-256, ssh-ed-25519,ssh-rsa, ssh-dss

 

AES-256 is the generally accepted strongest encryption standard offered by SSH – it is the Advanced Encryption Standard using a 256 bits cryptographic key. This is also known as the Rijndael algorithm which is a symmetric block cipher capable of using cipher keys that have 128, 192 and 256 bit lengths to process data blocks of 128 bits.

 

The GSW SSH server can be configured to refuse a connection if the SSH client can not operate with AES-256. Weaker encryptions only compromise the security of the connection so only the strongest encryption can be configured to ensure the strongest protection - while maintaining exceptional performance.  AES-256 encryption is available on almost all SSH clients. Of course other encryptions are supported such as 3DES. The GSW SSH Server will negotiate with the client to agree on the algorithm unless configured otherwise.

 

·                     No manual installation of certificates needed

Additionally, it has been identified that in many cases the administrative requirements for public and private certificate installation are not needed or desired. Using traditional, manual methods the installation of certificates on RF devices can be complex and cumbersome.  No public/private key generation or administration is required.

 

However, those with the requirements can take full advantage of the security offered by Digital Certificates and Public Keys using the innovative and easy to use SSH Shield Certificate Mapping Tool.

 

 

Component Architecture

The GSW SSH is composed of:

§  The GSW Universal Terminal Server (UTS)

§  The GSW SSH Shield

The GSW UTS is the software module that contains the core software for the GSW Server products, and the majority of the Advanced Features for the GSW Server Products 

Figure 1: GSW Server Products Block Diagram

The GSW UTS standard option for the Protocol and Interface is the Telnet Interface. This configuration is marketed and sold as the GSW Telnet Server.

Figure 2: GSW Telnet Server Block Diagram

 

 

 

The GSW UTS SSH interface is installed by applying the GSW SSH Shield to the GSW UTS. The GSW SSH Shield disconnects the Telnet Protocol Interface and installs the SSH Interface.

This configuration is marketed and sold as the GSW SSH Server

Figure 3: GSW SSH Server Block Diagram

 


Installation

Overview

When you purchased the GSW SSH Server you either:

 

  1. Own a GSW Telnet Server  (UTS) and are upgrading to the  SSH Server

      OR

  1. A new customer purchasing the GSW SSH Server[4].

 

 

If you own a GSW Telnet Server and are upgrading to the SSH Server then:

  1. You must have GSW Telnet Server Version 6.50 or higher to install the SSH Shield. The Telnet Interface becomes disabled when the SSH Shield is installed. If you have an older version then you will need to upgrade to the Version 6.50 or higher before you can apply the SSH Shield.
  2. Next install the GSW SSH Shield
  3. Register the GSW SSH Server.

 

If you are purchasing a new GSW SSH Server then:

  1. You will receive the current version of the GSW Telnet Server. Install the GSW Telnet Server according to the Installation Instruction in the GSW UTS User Manual. You do not need to register the Telnet Server at this time. Registration takes place after the installation of the GSW SSH Shield.
  2. Next install the GSW SSH Shield
  3. Register the GSW SSH Server.

 

NOTE: The GSW SSH Server requires registration. The registration for the GSW UTS is not sufficient for the GSW SSH Server.

 


 

Procedure

 

Installation of the GSW SSH Server software is simple and quick. From Windows 7/8/2008/R2/2012/R2/2016, NT/XP/VISTA/2000/2003, perform the following:

1.       Run the setup program (sshshld.exe). The Welcome screen of the setup program is displayed and you are reminded and urged to exit all windows programs before continuing. You are also reminded that you must have administrative privileges to install this program. Click Next.

 

Figure 4: Installation Welcome Screen

 

 

 

 

 

1.      A screen is displayed indicating the folder where the GSW SSH Shield will be installed. The default is:

C:\Program Files\Georgia SoftWorks\Georgia SoftWorks SSH SHIELD. 

You may change the installation directory at this time.  Note: Make sure that the users of the SSH Server have full access to the installation directory.

 

Figure 5: Installation – Choose Destination Folder

      Select the Program Folder for the SSH Server. Click Next.


 

2.      A shell opens a window with installation status lines similar to the figure below.

 

Figure 6: Installation – Command Shell Status Lines

3.      Now the Setup is complete! Click Finish and Now it’s time to register the SSH Server!

 

Figure 7: Installation Complete

 

 

Please view the readme.txt file as it may contain late breaking information about the SSH Server that has not yet made it into the User Manual. Release notes are also contained in the readme.txt file.

 

Figure 8: GSW UTS Program Group

Installation will result in the Georgia SoftWorks program group item “Installation Status” showing 23GSW SSH as installed. Additionally, the version of the GSW SSH Shield is displayed along with the status of the server and other Georgia SoftWorks software that may be installed.

Figure 9: SSH Installation Status (Your version will be shown in the fields above)


Registration

The GSW SSH Server is licensed for a single server. The license must be activated for the software to operate. To activate the license a valid Serial Number is required and is examined periodically by the SSH Server software. The Serial Number also allows new versions to be downloaded and installed for the duration of your subscription plan.

 

Two methods exist to obtain a valid Serial Number.

 

  1. Registration via Floating License

The Serial Number is pre-programmed into a specific hardware key that came with your purchase. The hardware key connects to a parallel or USB port on the server. See page 25 for details on registration via the Floating License.

 

  1. Registration via Software Serial Number.

This method exists for environments that do not support Parallel or USB ports. In brief this entails providing GSW with a machine specific Product ID. A Serial Number is generated based on the Product ID. This is usually performed via the GSW Ticket System, however is some cases email, fax or telephone. See page 32 for details on Software registration.

 

Floating License – Overview

The Georgia SoftWorks Floating License provides the flexibility to rapidly move the GSW SSH Server from one machine to another.  If you are unable to use the Floating License - skip this section and go to the section on Registration via Software Serial Number on page 32.

NOTE: When a SSH Server Pack is purchased (SSH Server and GSW Telnet Server), the same physical Floating License will contain valid Serial Numbers for both products.

With the Floating License NO software registration is required for the SSH Server to operate.

Common scenarios where the Floating License is useful include:

·         Laboratory usage in a development or test environment where the SSH Server is required for short periods of time on any particular machine and then moved to a new machine.

·         Backup Servers in a production environment. Typically multiple SSH Servers are purchased for backup systems, however with a Floating License the Hardware Key can be quickly moved from the primary machine to the backup without any other registration requirements.

·         Environments where a failed server must be replaced or rebuilt and immediately restored to operation with full SSH Server capability.

The Georgia SoftWorks Floating License is a hardware key that connects to a female parallel port connector or USB Port on the server. The parallel port Floating License does not impact functionality of the port for other uses. The parallel hardware key acts as a pass-through allowing normal connections to the other side of the key.

The Georgia SoftWorks Floating License is a hardware key that can be ordered for a Parallel or USB Port.

Parallel Port Floating License

USB Floating License

Figure 10: Floating License – Parallel Port

The Parallel Port Floating License is a Pass Through allowing normal function of the port.

Figure 11: Floating License - USB Port

Not attached to a Server

 

The Parallel Port Floating License connects to a female parallel port on the server and does not impact functionality of the port for other uses. It acts as a pass though allowing normal connections to the other side of the key.

USB LED Lights when Installed

 

Figure 12: Floating License - Hardware Key

The SSH Server will recognize the presence of the key and activate the software with the proper date for which free version upgrades can be obtained. It does not matter which parallel or USB port on the server the Hardware Key is installed, as all ports will be scanned for the installation of the key.

The Floating License currently is installed using the manufacturer SafeNet, previously Aladdin of the hardware key’s setup program. It is described below. The name of the hardware key is HASPHL and you will see it displayed in the setup screens. The best drivers for the HASP4 are the HASP HL drivers.

 


Floating License – Hardware Key Installation Instructions

 

Note: If you are using a USB Floating License on a Windows NT system - run the file aksnt4usb.exe prior to the following steps.

Note: Install the Floating License drivers before plugging into the USB port.

1.      Copy the files from the Floating License folder (hardkey) on the provided CD to the hard drive on your server.

2.      Run the HASPUserSetup.exe program and follow the installation instructions.  After installation of the hardware key install the GSW SSH Server as described on page 20 (if it is not already installed).

3.      If you have User Account Control enabled you may get a prompt that says “Do you want to allow the following program to make changes to this computer?” Click Yes

Figure 13: User Account Control

 

 

4.      You will first see the SafeNet (formerly Aladdin) initial Welcome Screen.

Figure 14: SafeNet welcome screen - computing space requirements

5.      You will first see the SafeNet  complete Welcome Screen, Click Next

Figure 15: SafeNet welcome screen - second part

6.      The next screen displayed is the SafeNet License Agreement screen.

Figure 16: SafeNet License Agreement 

7.      Read the license agreement and select “I accept the license agreement”, and then Click Install.

Figure 17: SafeNet License Agreement - Read and Accept

8.      The SafeNet Ready to install screen is displayed. Click Next.

 

Figure 18: SafeNet – Ready to Install

9.      The SafeNet Updating System screen is displayed.

Figure 19: SafeNet Validating Install

10.  The SafeNet Successfully Installed Screen is displayed. Click Finish.

Figure 20: SafeNet Successful Installation

11.  Plug the hardware key onto the parallel or USB port on the server.

NOTE: On some systems you may have to reboot the server after installation. If the Floating License is not recognized (by the UTS) after installing the driver, please reboot the server.

 

Uninstall Floating License – (Hardware Key)

 

In the event that you need to uninstall the Floating License (SafeNet HaspHL) please use the Windows Control Panel Add/Remove Programs administrative utilities.

 

NOTE:  Removing or uninstalling the Floating License will disable the GSW UTS Server.


 

Registration via Software Serial Number

To run the GSW SSH Server you must first register the software. (This registration is NOT required if you installed the Floating License, Page 25) Registration via Software Serial Number entails just a few steps that involve obtaining the Product ID and providing this Identification to Georgia SoftWorks so a Serial Number can be generated. Georgia SoftWorks will provide you with the Serial Number based on the Product ID. When you enter the Serial Number into the Registration Tool, click Register.

NOTE: Read System Signature chapter at the end of manual (page 115).

How to Register the Software

To run the registration software -

·         Select the Start button on the task bar; select Programs, then Georgia SoftWorks UTS Server and right click on Registration and Run as Administrator.

Prior to registering the SSH Server, a reminder dialog is presented indicating that the SSH Shield is not registered.

Figure 21: Registration – SSH Shield is not registered for use

 

The GSW SSH Server will be fully functional for a Trial Period of 30 days without requiring registering when installed for the first time on a system.  Click OK

IMPORTANT NOTE: If you already own a GSW Telnet Server and you want to run a 30 day trial of the GSW SSH Server then you will need to request a 30 day trial serial number from Georgia SoftWorks.  Please save a copy of the current SERIAL NUMBER for your telnet server prior to installing a 30 day trial GSW SSH Server. In the event that you do not purchase the GSW SSH Server prior to the expiration of the trial, you will need to apply your original serial number to re-activate the original GSW Telnet Server.
Next, the registration screen is displayed. The Registration program automatically fills in the Product Information fields as shown in the figure below. Complete the Customer Information fields as shown in the figure below.

Note: The Product Information Name and Version must contain valid data or it will not generate a correct Product ID.

Figure 22: GSW Registration - Initial Screen

Note that the Customer Information and Serial Number in the Registration Information may be already filled. This will be the case if the GSW UTS has previously been registered and operating as the GSW Telnet Server.

The registration information must be provided to Georgia SoftWorks to obtain the Serial Number. Several methods are available for your convenience.

 

1.      Please complete the Customer Information, including the Purchased From and the Application software fields in the Registration Screen.

The registration information must be provided to Georgia SoftWorks to obtain the Serial Number. Several methods are available for your convenience.

 

 

2.      Go to: http://www.georgiasoftworks.com/support_ost/open.php to submit a ticket for Registration. Complete necessary fields and attach the file you saved in the previous step. - Preferred method.

OR

1. Email the file to registration@georgiasoftworks.com

2. Print the information and Fax it to Georgia SoftWorks- 706.265.1020

Once Georgia SoftWorks receives the information, we can generate a Serial Number on demand and will send it to you. You may close the registration program at this time.

3.      When the Serial Number is provided run the Registration Program (see page 32) again and enter the Serial Number. The easiest method to get the serial number is to highlight the returned Serial Number and copy (ctrl-c). Then position the mouse in the Serial Number field in the Registration Information box and paste (ctrl-v). 

Figure 23: Registration - Serial Number Applied


 

4.      Click Register.

Figure 24: Registration Successful Screen

 

5.      Click OK.

 

Now the software is registered.

You will notice that in this case the Parameter field in the registration form is set to 3000, SSH Shield. This indicates that the SSH Server is installed and registered and is enabled for 3000 sessions.

Figure 25: Registration Verification


If you have purchased the Federal Information Processing Standards Publications (FIPS 140-2) option, you can verify that it is enabled by viewing the registration screen as shown below in Figure 26. Please note that the GSW SSH Server must be installed for the FIPS option to be available. GSW True FIPS 140-2 compliant connections can be identified using the GSW Session Administrator in the GSW UTS Server. Please see the GSW UTS Users Guide for further details.

 

Figure 26: Registration - Verify that FIPS 140-2 is Enabled

 

IMPORTANT: READ SYSTEM SIGNATURE CHAPTER AT END OF MANUAL (page 115).

You may now run the Georgia SoftWorks SSH Server. Note that you will be able to obtain Free Updates until the date specified.


GSW SSH Server

After Installation and Registration the GSW SSH Server is ready to use.

You can further configure the SSH Server to use more advanced features as needed. See page 44. Power configuration options for the SSH Server are implemented as common Universal Terminal Server configuration parameters. See User Manual for the GSW Universal Terminal Server for information on the powerful features available to the GSW SSH Server. 

Using the Installation Status Program Item within Georgia SoftWorks UTS program group, you can view the Installation Status of the GSW UTS and SSH Server.

 

 

Figure 27 - GSW Software Installation Status Tool


The Windows Services Utility can be used to view and alter the status of the GSW SSH and the GSW UTS services.

 

 

Figure 28: Control Panel - GSW SSH Services Started

The Georgia SoftWorks GSW_SSHD service and the Georgia SoftWorks Universal Terminal Server should both have a status of Started and a Startup Type of Automatic.

 

Using the Windows Services utility is the recommended method to start and stop the GSW services when required.

 


GSW FIPS 140-2 Compliant Option

GSW provides a Federal Information Processing Standards Publication (FIPS) 140-2 compliant option for those entities with requirements to meet cryptographic module security standards to protect sensitive and valuable data. FIPS standards are either mandated or recommended for use in federal government information technology (IT) systems.

Georgia SoftWorks undertook a purposed and specific development effort in order to provide required FIPS 140-2 compliant SSH server and client software to the United States Military.  Having completed this task, GSW is able to make this software available to other branches of the Federal government as well as State governments and other institutions including research, educational and commercial.

Software Requirements

In addition to the development required for FIPS 140-2 compliance of the GSW server and client software, the GSW mobile clients must run on an operating system that is FIPS 140-2 certified or provides a cryptographic module that has been certified.

In order for your SSH connections to be FIPS 140-2 compliant you must ensure that you have the minimum GSW software versions as well as the proper Windows Mobile/CE operating system version.

Software Requirements for FIPS Compliancy

 

GSW Software

Version

 

 

Certificate

GSW UTS Server

GSW SSH Server

7.50+

 

 

#918

#918

7.50+

 

 

GSW Desktop Clients

7.50+

 

 

#918

GSW CE/Mobile Clients

7.50+

 

 

#560,# 825

 

 

 

 

 

Table 1: GSW Software versions required for FIPS 140-2

Required Device Operating System  for Mobile/CE Clients

 

 

 

Certificate

Windows CE 5.0

Depends on Vendor

- Made available to OEMs via Windows Update 061211_KB911762

 

 

 

#560

Windows Mobile 5.0

 

 

 

#560

Windows CE 6.0

 

 

 

#825

Windows Mobile 6.0+

 

 

 

#825

 

 

 

 

 

Table 2: Device Operating System Versions Required for FIPS 140-2

The significant aspect of the client device operating system is that the version of the cryptographic module rsaenh.dll must be NIST (National Institute of Standards and Technology) certified, which begins with build 14343.0.0. With Windows CE 5.0 extra attention should be taken to ensure the version of rsaenh.dll. This may require contacting the device vendor to determine the correct version number of that cryptographic module.


Enable Option

FIPS 140-2 must be enabled on both the GSW SSH server and the GSW clients to complete a FIPS 140-2 compliant connection.

 Figure 29: GSW True FIPS 140-2 Connection – Server and Client

ENABLE FIPS 140-2 ON SSH SERVER

Proper registration will enable the FIPS option on the SSH Server.  View the registration tool to ensure the GSW SSH Server is registered with the FIPS option enabled.  Select the Start button on the task bar; select Programs, then Georgia SoftWorks UTS and then Registration. The current registration information is displayed.

Figure 30: FIPS 140-2 Option Enabled

In the Parameter field you will observe the number of concurrent sessions allowed followed by the text “SSH Shield” indicating that the GSW SSH server is licensed and FIPS indicating that the FIPS 140-2 option is enabled.


ENABLE FIPS 140-2 ON GSW MOBILE/CE and DESKTOP CLIENTS

 

GSW Desktop Client

Use the “–i” command line parameter when launching on GSW Desktop clients to enable FIPS 140-2 option. Please see the UTS user’s guide for a description and examples of desktop client command line options.

When FIPS 140-2 enabled GSW desktop clients are launched  you will receive a banner indicating that the “-i” command line parameter was issued by the client.

Figure 31: Desktop Client "-i" option issued

Please note that to have a both ends (client and server) FIPS 140-2 compliant, FIPS 140-2 must be enabled on the GSW SSH Server too.

 

 

 

 

 

 


GSW Windows Mobile/CE Clients

Enable FIPS140-2 on GSW Mobile/CE clients via the Encryption list box. The Mobile/CE device screen that you see will be similar to the ones below.

 

 

Figure 32: Enable FIPS 140-2 on GSW Mobile Clients

 

Please note that to have a both ends (client and server) FIPS 140-2 compliant, FIPS 140-2 must be enabled on the GSW SSH Server too.

 


FIPS 140-2 Connections

 

Using the UTS Session Administrator you can verify True GSW FIPS 140-2 compliant connections. An asterisk “*” will be prepended to the user name for connections that are FIPS 140-2 compliant for both the client and the server.

The possibility exists that a third party client may be FIPS 140-2 compliant but it cannot be verified unless it is a GSW client.

Figure 33: Verify FIPS 140-2 Compliant Connections

.

 


Configuration

No configuration is required beyond installation in order for the GSW SSH Server to operate providing secure logon, strong encryption and data integrity on an insecure network. Optional SSH Configuration is provided to implement advanced features. The GSW SSH Server reads configuration values each time the GSW_SSHD service is started.

 

Please consider the optional GSW UTS GUI Configuration tool for SSH provisioning or use the methods described below.

 

Registry Key Locations

 

Registry keys referenced in this User’s Guide are located here on 32 bit operating systems

HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters

Registry keys referenced in this User’s Guide are located here on 64 bit operating systems

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Georgia SoftWorks\GSW_SSHD\Parameters

 

Allow user to use SCP channel

 

Allow/Disallow users using transfer files using the Secure Copy protocol. The use of the “scp channel” is defined as defined in the SSH Connection Protocol.

 

Example using PuTTy’s secure copy is:

 

pscp -l mike -pw (zPro2@@5) -2 -v tt.txt mike@gsw2003:pp.txt

 

 

You can Allow/Disallow this capability by modifying the following registry key.

 

This configuration is contained in the registry key bAllowServiceSCP. The key is:

  HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\bAllowServiceSCP

The default value is 0x0 (Do not allow Secure Copy protocol). The value 1 allows the use of the Secure Copy Protocol.

Note that szSFTPRoot (page 46) must be set for SCP to work.

The following is the procedure to change the registry key for allowing the use of the “scp channel.”

1. Click the Start button at the bottom left corner of your screen.

2. Click RUN

3. Type REGEDIT

4. Click OK

5. Select Registry Key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\GS_Tnet\Parameters\bAllowServiceSCP

6. Select the menu item Edit and then click on Modify

7. Enter the new value for the bAllowServiceSCP and click OK

The new value will take effect when the GSW SSHD service is restarted.

 

Allow user to start a remote Shell

 

Allow/Disallow users use of the ‘shell” channel as defined in the SSH Connection Protocol. This functionality may be accessed using ssh client software.

 

You can Allow/Disallow this capability by modifying the following registry key.

 

This configuration is contained in the registry key bAllowServiceShell . The key is:

  HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\bAllowServiceShell

The default value is 0x01. (Allow remote shell). The value 0x00 disallows the use of a remote shell.

The following is the procedure to change the registry key for allowing the use of a “shell.”

1. Click the Start button at the bottom left corner of your screen.

2. Click RUN

3. Type REGEDIT

4. Click OK

5. Select Registry Key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\GS_Tnet\Parameters\bAllowServiceShell

6. Select the menu item Edit and then click on Modify

7. Enter the new value for the bAllowServiceShell and click OK

The new value will take effect when the GSW SSHD service is restarted


Allow user to use SFTP subsystem

 

Allow/Disallow users use of the SFTP subsystem as defined in the SSH Connection Protocol. This functionality may be accessed using sftp  client software.

 

You can Allow/Disallow this capability by modifying the following registry key.

 

This configuration is contained in the registry key bAllowSFTP . The key is:

  HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\bAllowServiceSFTP

The default value is 0x00. (Disallow use of SFTP subsysteml). The value 0x01 allows the use of a sftp subsystem.

The following is the procedure to change the registry key for allowing the use of the sftp subsystem.

1. Click the Start button at the bottom left corner of your screen.

2. Click RUN

3. Type REGEDIT

4. Click OK

5. Select Registry Key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\GS_Tnet\Parameters\bAllowSFTP

6. Select the menu item Edit and then click on Modify

7. Enter the new value for the bAllowServiceSFTP and click OK

The new value will take effect when the GSW SSHD service is restarted

 

Specify the SFTP Root Folder

 

Specify the root folder for SFTP and SCP (page 44). This parameter must point to a valid local folder.

For example C:\sftproot.

 

The use’s sftp path is set to this value with the domain name and user name appended.

 

Domain: receiving

User name: bob

For example C:\sftproot\receiving\bob.

 

Note: The system administrator must ensure that receiving\bob has access to this folder and its subfolders.

 

This configuration is contained in the registry key szSFTPRoot . The key is:

  HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\szSFTPRoot

The default value is the empty string.

The following is the procedure to change the registry key for specifying the SFTP  Root Folder..

1. Click the Start button at the bottom left corner of your screen.

2. Click RUN

3. Type REGEDIT

4. Click OK

5. Select Registry Key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\GS_Tnet\Parameters\szSFTPRoot

6. Select the menu item Edit and then click on Modify

7. Enter the new value for the szSFTPRoot and click OK

The new value will take effect when the GSW SSHD service is restarted

 

Allow user certificate logon

 

Enable or disable user Digital Certificate Logon

 

Users are allowed to use Digital Certificates for logon authentication.

Some environments may want to restrict this capability and not allow Digital Certificate Logons.

This can be controlled by the registry key bEnableLogonCertificate . The key is:

  HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\bEnableLogonCertificate

The default value is 0x01. (Allow Digital Certificate Logon). The value 0x00 disallows Digital Certificate Logon.

The following is the procedure to change the registry key for enabling or disabling Digital Certificate Logon.

1. Click the Start button at the bottom left corner of your screen.

2. Click RUN

3. Type REGEDIT

4. Click OK

5. Select Registry Key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\GS_Tnet\Parameters\bEnableLogonCertificate

6. Select the menu item Edit and then click on Modify

7. Enter the new value for the bEnableLogonCertificate and click OK

The new value will take effect when the GSW SSHD service is restarted


Allow user public key logon

 

Enable or disable Public Key Logon

 

Users are allowed to use public key authentication.

Some environments may want to restrict this capability and not allow public key authentication.

This can be controlled by the registry key bEnableLogonPublicKey . The key is:

  HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\bEnableLogonPublicKey

The default value is 0x01. (Allow public key logon). The value 0x00 disallows public key Logon.

The following is the procedure to change the registry key for enabling or disabling public key Logon.

1. Click the Start button at the bottom left corner of your screen.

2. Click RUN

3. Type REGEDIT

4. Click OK

5. Select Registry Key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\GS_Tnet\Parameters\bEnableLogonPublicKey

6. Select the menu item Edit and then click on Modify

7. Enter the new value for the bEnableLogonPublicKey and click OK

The new value will take effect when the GSW SSHD service is restarted

 

Allow User Name/Password logon

 

Enable or disable user name/password logon

 

Users are allowed to use user name/password logon authentication.

Some environments may want to restrict this capability and not allow user name/password authentication.

 

This can be controlled by the registry key bEnableLogonPassword . The key is:

  HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\bEnableLogonPassword

The default value is 0x01. (Allow user name/password logon). The value 0x00 disallows user name/password logon.

The following is the procedure to change the registry key for enabling or disabling user name/password logon.

1. Click the Start button at the bottom left corner of your screen.

2. Click RUN

3. Type REGEDIT

4. Click OK

5. Select Registry Key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\GS_Tnet\Parameters\bEnableLogonPassword

6. Select the menu item Edit and then click on Modify

7. Enter the new value for the bEnableLogonPassword and click OK

The new value will take effect when the GSW SSHD service is restarted

 

Allow user GSSAPI logon

 

Enable or disable GSSAPI logon authentication

 

Users are allowed to use GSSAPI logon authentication.

Some environments may want to restrict this capability and not allow GSSAPI authentication.

 

This can be controlled by the registry key bEnableLogonGSSAPI. The key is:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Georgia SoftWorks\GSW_SSHD\Parameters\bEnableLogonGSSAPI

The default value is 0x01. (Allow GSSAPI  logon). The value 0x00 disallows GSSAPI logon.

The following is the procedure to change the registry key for enabling or disabling user name/password logon.

1. Click the Start button at the bottom left corner of your screen.

2. Click RUN

3. Type REGEDIT

4. Click OK

5. Select Registry Key:

 

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Georgia SoftWorks\GSW_SSHD\Parameters\bEnableLogonGSSAPI

6. Select the menu item Edit and then click on Modify

7. Enter the new value for the bEnableLogonGSSAPI and click OK

The new value will take effect when the GSW SSHD service is restarted

 

Listen on IPv4 interfaces

 

Specify the address SSH Shield listens on for IPv4 connections.

 

This can be controlled by the registry key szBindIPv4Address. The key is:

  HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\szBindIPv4Address

The default value is the empty string. (Listen on all IPv4 interfaces).

The following is the procedure to change the registry key to specify the address to listen for IPv4 connections.

1. Click the Start button at the bottom left corner of your screen.

2. Click RUN

3. Type REGEDIT

4. Click OK

5. Select Registry Key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\GS_Tnet\Parameters\szBindIPv4Address

6. Select the menu item Edit and then click on Modify

7. Enter the new value for the szBindIPv4Address and click OK

The new value will take effect when the GSW SSHD service is restarted

 

Listen on IPv6 interfaces

 

Specify the address SSH Shield listens on for IPv6 connections.

 

This can be controlled by the registry key szBindIPv6Address. The key is:

  HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\szBindIPv6Address

The default value is the empty string. (Listen on all IPv6 interfaces).

The following is the procedure to change the registry key to specify the address to listen for IPv6 connections.

1. Click the Start button at the bottom left corner of your screen.

2. Click RUN

3. Type REGEDIT

4. Click OK

5. Select Registry Key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\GS_Tnet\Parameters\szBindIPv6Address

6. Select the menu item Edit and then click on Modify

7. Enter the new value for the szBindIPv6Address and click OK

The new value will take effect when the GSW SSHD service is restarted

 

Allow use of the “Exec” channel

 

Allow/Disallow users using the “exec” channel as defined in the SSH Connection Protocol.

This functionality may be accessed as shown in this example

 

ssh luke@gsw2003 cmd /c dir

 

You can Allow/Disallow this capability by modifying the following registry key.

 

This configuration is contained in the registry key bAllowServiceExecute . The key is:

  HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\bAllowServiceExecute

The default value is 0x0 (Do not allow access to the “exec” channel). The value 1 enables the use of the “exec” channel.

The following is the procedure to change the registry key for allowing the use of the “exec” channel.

1. Click the Start button at the bottom left corner of your screen.

2. Click RUN

3. Type REGEDIT

4. Click OK

5. Select Registry Key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\GS_Tnet\Parameters\bAllowServiceExecute

6. Select the menu item Edit and then click on Modify

7. Enter the new value for the bAllowServiceExecute and click OK

The new value will take effect when the GSW SSHD service is restarted

 

Enable RSA Host Key

 

Enable or disable the use of the RSA host key for server-client-authentication.

 

This can be controlled by the registry key bAllowRSAHostKey. The key is:

  HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\bAllowRSAHostKey

The default value is the 0x01 . (RSA Host Key is enabled to be used for server-to-client authentication).  0x00 will disable its use for server-to-client authentication.

The following is the procedure to change the registry key to enable or disable the use of the RSA Host Key.

1. Click the Start button at the bottom left corner of your screen.

2. Click RUN

3. Type REGEDIT

4. Click OK

5. Select Registry Key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\GS_Tnet\Parameters\bAllowRSAHostKey

6. Select the menu item Edit and then click on Modify

7. Enter the new value for the bAllowRSAHostKey and click OK

The new value will take effect when the GSW SSHD service is restarted

 


Enable DSA Host Key

 

Enable or disable the use of the DSA host key for server-client-authentication.

 

This can be controlled by the registry key bAllowDSAHostKey. The key is:

  HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\bAllowDSAHostKey

The default value is the 0x01. (DSA Host Key is enabled to be used for server-to-client authentication).  0x00 will disable its use for server-to-client authentication.

The following is the procedure to change the registry key to enable or disable the use of the DSA Host Key.

1. Click the Start button at the bottom left corner of your screen.

2. Click RUN

3. Type REGEDIT

4. Click OK

5. Select Registry Key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\GS_Tnet\Parameters\bAllowDSAHostKey

6. Select the menu item Edit and then click on Modify

7. Enter the new value for the bAllowDSAHostKey and click OK

The new value will take effect when the GSW SSHD service is restarted

 

Enable ECDSA Host Key

 

Enable or disable the use of the ECDSA host key for server-client-authentication.

 

This can be controlled by the registry key bAllowECDSAHostKey. The key is:

  HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\bAllowECDSAHostKey

The default value is the 0x01. (ECDSA Host Key is enabled to be used for server-to-client authentication).  0x00 will disable its use for server-to-client authentication.

The following is the procedure to change the registry key to enable or disable the use of the ECDSA Host Key.

1. Click the Start button at the bottom left corner of your screen.

2. Click RUN

3. Type REGEDIT

4. Click OK

5. Select Registry Key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\GS_Tnet\Parameters\bAllowECDSAHostKey

6. Select the menu item Edit and then click on Modify

7. Enter the new value for the bAllowECDSAHostKey and click OK

The new value will take effect when the GSW SSHD service is restarted


Encryption algorithm categories and lists overview

The main categories of Encryption Algorithms are Host Key Algorithms, Key Exchange Algorithms, Ciphers and MACs. There are also public key and compression algorithms. Each category has a registry key where the value contains the list of algorithms that can be used. In some cases special values enable predefined lists of algorithms.

For each category there may be up to four algorithm lists that are preconfigured and ready to use.

·         GSW Default

·         FIPS 140-2 Disabled

·         FIPS 140-2 Enabled

·         All Available Algorithms

You may also create your own custom list of algorithms from the available algorithms. This gives you the flexibility to restrict connections to only certain strength algorithms or to allow only specific legacy algorithms or any combination thereof.

GSW determines the best available algorithms for each category at each release. The list of algorithms setup at installation for each category is called the “GSW Default Algorithms list”. No configuration is required to use the GSW Default Algorithms.

The FIPS 140-2 Enabled list is a list of algorithms that does not include any algorithms that are not supported by FIPS 140-2. When you Enable FIPS 140-2 and restart the SSH service, the FIPS 140-2 Enabled list is activated.

The FIPS 140-2 Disabled is a list of all the algorithms available.

In some cases there is no difference in the algorithms available for FIPS 140-2 Enabled and Disabled. We call this list “All Available Algorithms”. Not surprisingly, it is also used to refer to all the available algorithms.

If the empty string is configured for the value, then you get the complete list of algorithms available based on the FIPS 140-2 setting.


 

Specify Key Exchange Algorithms

Specify the Key Exchange algorithms available to the server that are offered to the client. The Key Exchange algorithms are offered to the client in the server’s default order unless specified. The default order will vary from release to release to deliver the best blend of security and performance.

 

Specify the ciphers that the server can offer to the client by modifying the registry key szKexAlgoritms. The key is:

  HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\szKexAlgorithms

The following is the default list for Key Exchange Algorithms.

curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1

The following is the list and order of all Key Exchange Algorithms available.

ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,diffie-hellman-group14-sha1Page

The list of Key Exchange Algorithms does not vary based the Enable/Disable value for FIPS 140-2 option.

The following is the procedure to change the registry key to specify the Key Exchange Algorithms available to the client.

1. Click the Start button at the bottom left corner of your screen.

2. Click RUN

3. Type REGEDIT

4. Click OK

5. Select Registry Key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\GS_Tnet\Parameters\szKexAlgorithms

6. Select the menu item Edit and then click on Modify

7. Enter the new value for the szKexAlgorithms and click OK

The new value will take effect when the GSW SSHD service is restarted


Specify Ciphers

Specify the ciphers available to the server that are offered to the client. The ciphers are available to the client in the server’s default order unless specified. The default order will vary from release to release to deliver the best blend of security and performance.

 

Specify the ciphers that the server can offer to the client by modifying the registry key szCiphers. The key is:

  HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\szCiphers

The following is the default list of ciphers.

aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes192-ctr,3des-cbc,aes128-ctr,aes128-gcm@openssh.com,aes256-cbc,rijndael256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,rijndael192-cbc,aes128-cbc,rijndael128-cbc,cast128-cbc,blowfish-cbc

The following is the list and order of all ciphers available with FIPs 140-2 disabled

aes128-cbc,chacha20-poly1305@openssh.com,aes128-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,3des-cbc,blowfish-cbc,aes192-cbc,aes192-ctr,aes256-cbc,aes256-ctr,rijndael128-cbc,rijndael192-cbc,rijndael256-cbc,rijndael-cbc@lysator.liu.se,cast128-cbc

 

The following is the list and order of ciphers available with the FIPS 140-2 option enabled.

aes128-cbc,aes128-ctr,3des-cbc,aes192-cbc,aes192-ctr,aes256-cbc,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,rijndael128-cbc,rijndael192-cbc,rijndael256-cbc,rijndael-cbc@lysator.liu.se

 

The registry parameter bDisableFIPS must be set to 1 to use algorithms which are not on the FIPS list. The default value of this parameter is 0.

The following is the procedure to change the registry key to specify the Ciphers available to the client.

1. Click the Start button at the bottom left corner of your screen.

2. Click RUN

3. Type REGEDIT

4. Click OK

5. Select Registry Key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\GS_Tnet\Parameters\szCiphers

6. Select the menu item Edit and then click on Modify

7. Enter the new value for the szCiphers and click OK

The new value will take effect when the GSW SSHD service is restarted

Specify Message Authentication Code Algorithms (MACs)

Specify the Message Authentication Code algorithms available to the server that are offered to the client. The Message Authentication Code algorithms are offered to the client in the server’s default order unless specified. The default order will vary from release to release to deliver the best blend of security and performance.

 

Specify the Message Authentication Algorithms that the server can offer to the client by modifying the registry key szMACs. The key is:

  HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\szMACs

The following is the default value for Message Authentication Code algorithms.

hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1-etm@openssh.com,hmac-sha1,hmac-sha1-96,hmac-md5,none

 

The following is the list and order of all algorithms available with the FIPS 140-2 option disabled.

hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,none

The following is the list and order of algorithms available with the FIPS 140-2 option enabled.

hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96

The registry parameter bDisableFIPS must be set to 1 to use algorithms which are not on the FIPS list. The default value of this parameter is 0.

The following is the procedure to change the registry key to specify the Message Authentication Code algorithms available to the client.

1. Click the Start button at the bottom left corner of your screen.

2. Click RUN

3. Type REGEDIT

4. Click OK

5. Select Registry Key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\GS_Tnet\Parameters\szMACs

6. Select the menu item Edit and then click on Modify

7. Enter the new value for the szMACs and click OK

The new value will take effect when the GSW SSHD service is restarted


Algorithm selection for GSW Desktop SSH Client

SSH clients provide a list of Host Key, Key Exchange, Ciphers and MAC algorithms to the SSH Server. The SSH Server goes through each list from the client and for each algorithm chooses the first match from lists that the server supports. If no match is found for any of the algorithms then the connection is refused.

GSW Desktop SSH client provides command line arguments to specify the algorithms and order that are presented to the SSH Server. Customers concerned about achieving high level of security should use the command line arguments to specify safe algorithms as noted in different algorithm tables starting on page 106. It is recommended to only use the safe algorithms, and not offer unsafe algorithms.

If you do not specify command lines arguments for the Desktop client, then defaults are used and noted in each section. The defaults are the strongest possible algorithms regardless of FIPs setting

For more detail on Command Line Options for the SSH Clients please see the section Georgia SoftWorks Desktop Client Command line options – Description in the GSW UTS Manual.

Host Key Algorithms List

GSW Desktop SSH Host Key Algorithms

(same list with FIPS 140-2 Disabled or Enabled)

·         rsa-sha2-512

·         rsa-sha2-256

·         ssh-rsa

·         ssh-dss

·         ecdsa-sha2-nistp521

·         ecdsa-sha2-nistp384

·         ecdsa-sha2-nistp256

Table 3: GSW Desktop Host Key Algorithms

If you do not specify the Host Key Algorithms then the default is:

Default Host Key Algorithms

·         rsa-sha2-512

See the master Host Key Algorithm list for all GSW SSH products on page 106. Safe algorithms are in green and unSafe are in red.


Key Exchange Algorithm List

GSW Desktop SSH Key Exchange Algorithms

(same list with FIPS 140-2 Disabled or Enabled)

·         ecdh-sha2-nistp256

·         ecdh-sha2-nistp384

·         ecdh-sha2-nistp521

·         curve25519-sha256

·         curve25519-sha256@libssh.org

·         diffie-hellman-group-exchange-sha256

·         diffie-hellman-group16-sha512

·         diffie-hellman-group14-sha256

·         diffie-hellman-group18-sha512

·         diffie-hellman-group-exchange-sha1

·         diffie-hellman-group1-sha1

·         diffie-hellman-group14-sha1

Table 4: GSW Desktop Key Exchange Algorithms

If you do not specify the Key Exchange Algorithms then the defaults are listed below:

Default Key Exchange Algorithms (in order):

·         diffie-hellman-group18-sha512

·         curve25519-sha256

 

See the Master Key Exchange algorithm list for all GSW SSH products on page 106. Safe algorithms are in green and unSafe are in red.

 


Ciphers List

Note: There are different lists for Ciphers depending if you have FIPs 140-2 enabled.

GSW Desktop SSH Client Ciphers

SSH with FIPS 140-2 Disabled

with FIPS 140-2 Enabled

·                     aes128-ctr[5]

·                     aes128-gcm@openssh.com

·                     aes128-cbc

·                     chacha20-poly1305@openssh.com

·                     3des-cbc

·                     blowfish-cbc

·                     aes192-ctr[6]

·                     aes192-cbc

·                     aes256-gcm@openssh.com

·                     aes256-ctr[7]

·                     aes256-cbc

·                     rijndael128-cbc

·                     rijndael192-cbc

·                     rijndael256-cbc

·                     rijndael-cbc@lysator.liu.se

·                     cast128-cbc

·         aes128-ctr5

·         aes128-gcm@openssh.com

·         aes128-cbc

·         3des-cbc

·         aes192-ctr6

·         aes192-cbc

·         aes256-ctr7

·         aes256-gcm@openssh.com

·         aes256-cbc

·         rijndael128-cbc

·         rijndael192-cbc

·         rijndael256-cbc

·         rijndael-cbc@lysator.liu.se

Table 5: GSW Desktop Ciphers - SSH and with FIPS 140-2

If you do not specify the Ciphers then the defaults are:

Default Ciphers (in order):

·         aes256-gcm@openssh.com

·         chacha20-poly1305@openssh.com

·         aes256-ctr

 

See the master Cipher list for all GSW SSH products on page 107. Safe algorithms are in green and unSafe are in red.

 


Message Authentication Code (MACs) list

Note: There are different lists for Message Authentication Code algorithms depending if you have FIPs 140-2 enabled.

GSW Desktop SSH MACs

SSH with FIPS 140-2 Disabled

with FIPS 140-2 Enabled

·         hmac-sha2-256-etm@openssh.com

·         hmac-sha2-512-etm@openssh.com

·         hmac-sha1-etm@openssh.com

·         hmac-sha2-256

·         hmac-sha2-512

·         hmac-sha1

·         hmac-sha1-96

·         hmac-md5

·         none

·         hmac-sha2-256-etm@openssh.com

·         hmac-sha2-512-etm@openssh.com

·         hmac-sha1-etm@openssh.com

·         hmac-sha2-256

·         hmac-sha2-512

·         hmac-sha1

·         hmac-sha1-96

 

Table 6: GSW Desktop MACs both SSH and FIPS 140-2

If you do not specify the MACs then the default is:

Default MACs:

·         hmac-sha2-512-etm@openssh.com

See the master Message Authentication Code (MACs) list for all GSW SSH products on page 108. Safe algorithms are in green and unSafe are in red.

 


 

 

SSH Desktop Client Command line Syntax

To manually specify the SSH encryption parameters for the GSW SSH Desktop Client, use the long style arguments on the SSH command line.

 

Note: Long style arguments have the syntax using the plus “+” sign followed by the argument name, then an equals sign “+” and then the list of algorithms comma separated.  These are the algorithms that can be configured on the SSH command line.

 

+HostKeyAlgorithms=<list_of_host_key_algorithms>

 

+KexAlgorithms=<list_of_kex_algorithms>

 

+Ciphers=<list_of_ciphers>

 

+Macs=<list_of_macs>

 

 

Example:SSH Desktop Client Command Line ARGUMENTS for Algorithms

When I connect to the SSH Server I want the high security and want to use the following algorithms.

 

Host Key Algorithm:      rsa-sha2-512

Key Exchange Algorithms: curve25519-sha256@libssh.org

Ciphers:                 aes256-ctr

MACs:                    hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

 

A typical command line would look as follows.

c:\gs_uts\gs_ssh –ujohndoe –d. -pmostsecure -hsoloman +Ciphers=aes256-ctr +KexAlgorithms=curve25519-sha256@libssh.org +HostKeyAlgorithms=rsa-sha2-512 +Macs=hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com 

Please note the above command is one a single line, so don’t be confused by the line wraps.

Please note that the other command line parameters in this example, –ujohndoe –d. –pmostsecure and

-hsoloman are just examples for a particular system. The emphasis of this example is to show the algorithms selected.

 


Change the SSH Port Number

               

The default port number is port 22. You can change the port number to the port of your choice.

Important: Be sure that you also change the port number on the SSH clients to the same port number configured on the SSH Server.

 

In the event you want to change the SSH port on the server you can do so by changing the following registry key.

 

This configuration is contained in the registry key usGSWSSHDPort which is a number. The key is:

  HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\usGSWSSHDPort

The default value is 22.

This following is a procedure to change the registry key for the SSH port number.

1.      Click the Start button at the bottom left corner of your screen.

2.      Click RUN

3.      Type REGEDIT 

4.      Click OK

5.      Select Registry Key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\GS_Tnet\Parameters\usGSWSSHDPort

6.      Select the menu item Edit and then click on Modify

7.      Enter the new value for the usGSWSSHDPort and click OK

8.      The new value will take effect when the GSW SSHD service is restarted.


Location of SSH Server RSA Private Key

     

The SSH Server RSA Private Key is in an encrypted file and is in the PEM format.

 

This configuration is contained in the registry key szServerRSAKeyFile which is a text string.

You can change the location by modifying the registry key.

 

The key is:

 

       HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\szServerRSAKeyFile

 

The default value is the installation folder for the GSW SSH Shield.

 

      C:\Program Files\Georgia SoftWorks\Georgia SoftWorks SSH Shield\sshd_rsa.key

 

The following is a procedure to change the Location of SSH Server RSA Private Key.

 

1.      Click the Start button at the bottom left corner of your screen.

 

2.      Click RUN

 

3.      Type REGEDIT 

 

4.      Click OK

 

5.      Select Registry Key

 

HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\szServerRSAKeyFile

 

6.      Select the menu item Edit and then click on Modify

7.      Enter the new value for the szServerRSAKeyFile and click OK

 

The new value will take effect when the GSW SSHD service is restarted.


 

Location of SSH Server DSA Private Key

     

The SSH Server DSA Private Key is in an encrypted file and is in the PEM format.

 

This configuration is contained in the registry key szServerDSAKeyFile which is a text string.

You can change the location by modifying the registry key.

 

The key is:

 

       HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\szServerDSAKeyFile

 

The default value is the installation folder for the GSW SSH Shield.

 

      C:\Program Files\Georgia SoftWorks\Georgia SoftWorks SSH Shield\sshd_dsa.key

 

 

1.      Click the Start button at the bottom left corner of your screen.

 

2.      Click RUN

 

3.      Type REGEDIT 

 

4.      Click OK

 

5.      Select Registry Key

 

HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\szServerDSAKeyFile

 

6.      Select the menu item Edit and then click on Modify

7.      Enter the new value for the Server DSA Key Location and click OK

 

 

The new value will take effect when the GSW SSHD service is restarted.


Location of SSH Server ECDSA Private Key

     

The SSH Server Elliptic Curve Cryptography DSA Private Key is in an encrypted file and is in the PEM format.

 

This configuration is contained in the registry key szServerECDSAKeyFile which is a text string. You can change the location by modifying the registry key.

 

The key is:

 

HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\szServerECDSAKeyFile

 

The default value is the installation folder for the GSW SSH Shield.

 

   C:\Program Files\Georgia SoftWorks\Georgia SoftWorks SSH Shield\sshd_ecdsa.key

 

 

1.      Click the Start button at the bottom left corner of your screen.

 

2.      Click RUN

 

3.      Type REGEDIT 

 

4.      Click OK

 

5.      Select Registry Key

 

HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\szServerECDSAKeyFile

 

6.      Select the menu item Edit and then click on Modify

7.      Enter the new value for the Server DSA Key Location and click OK

 

The new value will take effect when the GSW SSHD service is restarted.


Location of Fingerprints for all Host Keys

 

The file HostFingerPrints.txt in the Georgia SoftWorks SSH Shield installation folder[8] contains key fingerprints for all host keys offered for server-to-client authentication. These key fingerprints may be entered for host fingerprint configuration of the Georgia SoftWorks Business Tunnel.

The file is formatted as shown below:

RSA key MD5 fingerprint ........ d5:bb:19:47:87:05:95:16:a6:d2:ac:db:f1:fc:9c:19

 

RSA key SHA1 fingerprint ....... 8e:ae:0e:ee:05:32:a0:20:b7:10:56:8a:26:88:7b:f0:19:53:32:96

 

RSA key SHA-256 fingerprint .... 2b:f8:96:8b:5d:c9:9a:5b:18:41:ee:f9:e1:14:57:15:6f:49:84:05:55:b5:87:0c:28:1a:a0:3b:81:5c:d1:2c

 

DSA key MD5 fingerprint ........ cd:e8:1e:c8:f0:39:87:dc:1b:b5:18:64:69:56:a3:8b

 

DSA key SHA1 fingerprint ....... 5b:f9:8b:2a:9f:d9:15:48:da:37:38:93:90:3a:ba:e4:91:11:91:05

 

DSA key SHA-256 fingerprint .... 2f:71:bb:07:84:94:a3:67:59:2e:eb:7b:b2:2a:d9:67:63:60:0f:60:75:93:c1:72:f9:3d:d1:db:19:12:bb:ec

 

ECDSA key MD5 fingerprint ...... 8f:6a:6b:f2:11:25:ba:7e:b6:6c:dc:d7:79:26:66:1e

 

ECDSA key SHA1 fingerprint ..... 42:d0:69:23:e0:a2:b5:4b:04:cd:72:dc:2a:c8:1b:3a:49:c9:ec:1b

 

ECDSA key SHA-256 fingerprint .. 54:c4:e9:4f:4a:a4:d5:a6:dc:ac:8e:ec:b5:4f:8a:d6:82:76:90:d6:cf:04:18:73:55:0e:6d:88:36:8c:5c:b9

 

Internal SSH Activity Logging FLAG for Debugging

 

               

In the event that GSW Technical Support requires additional information, you may need to turn on SSH internal activity logging.

 

You can activate the internal SSH activity logging by modifying the following registry key.

 

This configuration is contained in the registry key bEnableWODLog which is a flag. The key is:

  HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\bEnableWODLog

The default value is 0.

1.      Click the Start button at the bottom left corner of your screen.

2.      Click RUN

3.      Type REGEDIT 

4.      Click OK

5.      Select Registry Key

 

HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\bEnableWODLog

 

6.      Select the menu item Edit and then click on Modify

7.    Enter the new value for the Enable Activity Logging  and click OK

The new value will take effect when the GSW SSHD service is restarted.


Internal SSH Activity Log file location for Debugging

 

               

In the event that GSW Technical Support requires additional information, you may need change the SSH internal activity log file location.

 

You can modify the internal SSH activity log file name and location by modifying the following registry key.

 

This configuration is contained in the registry key szWODLogFile which is a text string. The key is:

  HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\szWODLogFile

The default value is the log folder in the GSW UTS Installation directory. Usually this is:

               C:\GS_UTS\log

NOTE: bEnableWODLog must be set to 1 for the log file to operate.

Note: (you must be on the Windows NT/XP/VISTA/2000+ system that the Georgia SoftWorks SSH Server is installed. However, you may connect to the SSH Registry from a remote location).

1.      Click the Start button at the bottom left corner of your screen.

2.      Click RUN

3.      Type REGEDIT 

4.      Click OK

5.      Select Registry Key

 

HKEY_LOCAL_MACHINE\SOFTWARE\Georgia SoftWorks\GSW_SSHD\Parameters\szWODLogFile

 

6.      Select the menu item Edit and then click on Modify

7.    Enter the new value for the Enable Log File Name and Location and click OK

 

The new value will take effect when the GSW SSHD service is restarted.


SSH Server Mapping Tool for Certificates and Public Keys

Georgia SoftWorks researched and developed an innovative, easy to use, and secure implementation of the 'validation and mapping' stated above. All of the configuration is done through a GUI with wizard style dialogs reminiscent of IIS certificate-to-user account mapping. The solution preserves all of the cryptographic strength of the public key solution, adds convenient, well scaling, certificate-to-user account mapping options while eliminating the time consuming, error-prone, and potentially insecure setup. Georgia SoftWorks researched and developed an innovative, easy to use, and secure implementation of Digital Certificates[9]. The result of this effort is the GSW SSH SHIELD Certificate Mapping Tool.

The entire configuration is done through a GUI with wizard style dialogs reminiscent of IIS certificate-to-user account mapping. The solution preserves all of the cryptographic strength of the public key solution, adds convenient, well scaling, certificate-to-user account mapping options.

Figure 34 - SSH Certificate Mapping Tool

The overall solution allows authenticating SSH users who log on with a client certificate by mapping the certificates to Windows user accounts. The client certificates are analyzed and used to either deny or grant host access to a connecting session.

There are two methods in which one can map certificates.


Certificate One-to-one mapping

 

'One-to-one' mapping maps a individual client certificate to a individual Windows user account. The SSH-2 server compares certificates from a pre-configured list with the client certificate that is sent by the SSH-2 client. An identical match must occur for the mapping to proceed.

Figure 35 - One-to-one certificate mapping

Certificate Many-to-one mapping

 

'Many-to-one' mapping maps multiple certificates to an individual Windows user account. It uses wildcard matching rules to define the certificate criteria for mapping. This type of mapping does not compare the actual client certificate. Instead, it accepts all client certificates that meet specific criteria. If a certificate matches the rules, it is mapped to the indicated user account. Typically one would also select a Certificate Trust List (CTL) to assure the client certificates are truly trustworthy. CTLs make it possible to limit the number of acceptable root CAs which are able to issue certificates to users.

Figure 36 - Many-to-one certificate mapping

Public Key 1-to-1 mapping

 

Public Key '1-to-1' mapping provides a very nice method to allow public key to user account mapping.

Figure 37 - Public Key Mappings - 1-to-1


Certification Validation – Certificate Trust List

 

You can also configure Certificate Trust List (CTL) with the GSW Mapping Tool.

Figure 38 - Certificate Validation Certificate Trust List


Public/Private Key Creation and Use

Public / Private Key Introduction

 

Public key authentication is far more secure than passwords and provides exceptional usability benefits. The cryptographic strength of the recommended and trustworthy algorithms are superior to even the longest passwords. The user does not have to remember a password and Public Key Authentication provides automatic logon capabilities. The benefits are substantial.

When using this type of authentication, the entity (SSH client software) being authenticated has a public key and a private key. The private key is kept on the client, while the public key is stored on the server.

In this example we will generate a Public/Private key pair, install the private key on the client and the public key on the server. We also map the public key to a Windows user account, which provides automatic logon on.


Creating a Public / Private Key

 

There are a multitude of tools available to generate a Public/Private key pair, many at no cost. In this example we will use PuTTYgen to create a public and private key.

1.      Download PuTTYgen. Click on the PuTTYgen executable.

2.      Select the SSH-2 RSA radio button, near the bottom of the window.

3.      Create a key set by clicking on the “Generate” button.

 

Figure 39: Puttygen Tool for Creating Public/Private Key Pair

 

 

4.      Randomly move the mouse pointer in the open area under the progress bar, until the progress bar completes.

 

 

Figure 40: Puttygen Tool Uses Mouse-Movement to Create Randomness for Key Creation


5.      Once the progress bar completes, create an optional key Passphrase[10].

 

Figure 41: Puttygen with Generated Key