Enhance OpenSSH for Fun and Security Enhance OpenSSH for Fun and - PowerPoint PPT Presentation

Enhance OpenSSH for Fun and Security Enhance OpenSSH for Fun and Security Enhance OpenSSH for Fun and Security Enhance OpenSSH for Fun and Security Enhance OpenSSH for Fun and Security Enhance OpenSSH for Fun and Security Enhance OpenSSH for Fun and Security Enhance OpenSSH for Fun and Security Enhance OpenSSH for Fun and Security Enhance OpenSSH for Fun and Security Enhance OpenSSH for Fun and Security Enhance OpenSSH for Fun and Security Enhance OpenSSH for Fun and Security Enhance OpenSSH for Fun and Security Enhance OpenSSH for Fun and Security Enhance OpenSSH for Fun and Security Enhance OpenSSH for Fun and Security Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto LinuxCon Europe LinuxCon Europe LinuxCon Europe LinuxCon Europe LinuxCon Europe LinuxCon Europe LinuxCon Europe LinuxCon Europe LinuxCon Europe LinuxCon Europe LinuxCon Europe LinuxCon Europe LinuxCon Europe LinuxCon Europe LinuxCon Europe LinuxCon Europe LinuxCon Europe October 5, 2015 October 5, 2015 October 5, 2015 October 5, 2015 October 5, 2015 October 5, 2015 October 5, 2015 October 5, 2015 October 5, 2015 October 5, 2015 October 5, 2015 October 5, 2015 October 5, 2015 October 5, 2015 October 5, 2015 October 5, 2015 October 5, 2015

Match User roidelapluie Match User roidelapluie Match User roidelapluie Match User roidelapluie Match User roidelapluie Match User roidelapluie Match User roidelapluie Match User roidelapluie Match User roidelapluie Match User roidelapluie Match User roidelapluie Match User roidelapluie Match User roidelapluie Match User roidelapluie Match User roidelapluie Match User roidelapluie Match User roidelapluie Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto Julien Pivotto • Sysadmin at inuits .eu Sysadmin at inuits .eu Sysadmin at inuits .eu Sysadmin at inuits .eu Sysadmin at inuits .eu Sysadmin at inuits .eu Sysadmin at inuits .eu Sysadmin at inuits .eu Sysadmin at inuits .eu Sysadmin at inuits .eu Sysadmin at inuits .eu Sysadmin at inuits .eu Sysadmin at inuits .eu Sysadmin at inuits .eu Sysadmin at inuits .eu Sysadmin at inuits .eu Sysadmin at inuits .eu • FLOSS user since 2004 FLOSS user since 2004 FLOSS user since 2004 FLOSS user since 2004 FLOSS user since 2004 FLOSS user since 2004 FLOSS user since 2004 FLOSS user since 2004 FLOSS user since 2004 FLOSS user since 2004 FLOSS user since 2004 FLOSS user since 2004 FLOSS user since 2004 FLOSS user since 2004 FLOSS user since 2004 FLOSS user since 2004 FLOSS user since 2004 • DevOps believer DevOps believer DevOps believer DevOps believer DevOps believer DevOps believer DevOps believer DevOps believer DevOps believer DevOps believer DevOps believer DevOps believer DevOps believer DevOps believer DevOps believer DevOps believer DevOps believer • @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie on irc/twitter/github @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie @roidelapluie on irc/twitter/github on irc/twitter/github on irc/twitter/github on irc/twitter/github on irc/twitter/github on irc/twitter/github on irc/twitter/github on irc/twitter/github on irc/twitter/github on irc/twitter/github on irc/twitter/github on irc/twitter/github on irc/twitter/github @roidelapluie @roidelapluie @roidelapluie on irc/twitter/github on irc/twitter/github on irc/twitter/github

inuits .eu

World, 2015 World, 2015 World, 2015 World, 2015 World, 2015 World, 2015 World, 2015 World, 2015 World, 2015 World, 2015 World, 2015 World, 2015 World, 2015 World, 2015 World, 2015 World, 2015 World, 2015 Licensed under a Creative Commons Attribution 2.0 License https://www.flickr.com/photos/80497449@N04/10012162166

Connected devices Connected devices Connected devices Connected devices Connected devices Connected devices Connected devices Connected devices Connected devices Connected devices Connected devices Connected devices Connected devices Connected devices Connected devices Connected devices Connected devices • M M M M M M Mainframes M M M M M M M M M M • S S S S S S S S S S S S S S S S Servers • V V V V V V V V V V V Virtual machines V V V V V • C C C C C C C C C Containers C C C C C C C • I I I I I I I I I I I I I I I I IoT

Entrance Doors Entrance Doors Entrance Doors Entrance Doors Entrance Doors Entrance Doors Entrance Doors Entrance Doors Entrance Doors Entrance Doors Entrance Doors Entrance Doors Entrance Doors Entrance Doors Entrance Doors Entrance Doors Entrance Doors • P P P P P P P P P P P P P P P P Physical Access • T T T T T T T T T T Telnet T T T T T T • R R R R R R RSH R R R R R R R R R R • S S S S S S S S S SSH S S S S S S S • H H H H H H H H H H HTTPS H H H H H H • … … … … … … … … … … … … … … … … …

SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH • D D D D D D Dozens of implementations D D D D D D D D D D • O O O O O O O O O O O O O O O O OpenSSH • D D D D D D D D D D D Dropbear (embedded) D D D D D • C C C C C C C C C Closed-source C C C C C C C • … … … … … … … … … … … … … … … … …

SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH SSH • D D D D D D D D D D D Dozens of usecases D D D D D • S S S S S S S S S S S S S Shell access and TCP Tunelling S S S • C C C C C C C C C C C C C Code (git) C C C • F F F F F F F F F F F F F F F F File transfert (sftp) • X X X X X X X X X X X X X X X X X terminal (x2go) • A A A A A A A A A A A A A A A A Automation (ansible) • … … … … … … … … … … … … … … … … …

OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH Licensed under a Creative Commons Attribution 2.0 License https://www.flickr.com/photos/pennuja/5399766800

OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH OpenSSH • D D D D D D Developed by the OpenBSD project D D D D D D D D D D • R R R R R R Released first in 1995 R R R R R R R R R R • S S S S S S S S S Server/Client implementation S S S S S S S • I I I I I I I I Included in BSD, Linux, Cygwin, Mac OS X, … I I I I I I I I • A A A A A A A A A A A A A A A A Available in many other platforms

Out of scope Out of scope Out of scope Out of scope Out of scope Out of scope Out of scope Out of scope Out of scope Out of scope Out of scope Out of scope Out of scope Out of scope Out of scope Out of scope Out of scope • F F F F F F Firewalling, OS, … F F F F F F F F F F • B B B B B B B B Basic tips: RootLogin, Pubkeys, … B B B B B B B B • C C C C C C C C C C C C C C C C Crypto/Encryption/Key Exchanges https://stribika.github.io/2015/01/04/secure-secure- shell.html

Security Security Security Security Security Security Security Security Security Security Security Security Security Security Security Security Security Licensed under a Creative Commons Asstribution-ShareAlike 2.0 License https://www.flickr.com/photos/111692634@N04/11406986014

Common sense Common sense Common sense Common sense Common sense Common sense Common sense Common sense Common sense Common sense Common sense Common sense Common sense Common sense Common sense Common sense Common sense • D D D D D D D D Do you need SSH? (immutable infra, containers…) D D D D D D D D • K K K K K K K K KISS K K K K K K K K • C C C C C C C C Chose what will get public IP and then exposition.. C C C C C C C C hypervisors vs vms? • P P P P P P P P P P P P P P P P Port 22 is not Evil

Server-side Server-side Server-side Server-side Server-side Server-side Server-side Server-side Server-side Server-side Server-side Server-side Server-side Server-side Server-side Server-side Server-side Licensed under a Creative Commons Attribution 2.0 License https://www.flickr.com/photos/56001405@N06/6187271613