TELNET, SSH, FTP & SFTP [LU]

TELNET v. SSH

In an anecdotal way, the differences between Telnet and SSH (as well as SFTP and FTP) can be compared to the "changing of the times". I remember a time not too long ago when many people left their doors unlocked and the car keys in the ignition! Security was not really much of an issue because most people minded their own and did not infringe upon others' property and information. Certainly the times have changed and now we have complex security systems to protect our cars, homes, and even our computers now. There are lots of people out there who would love to get their hands on other people's information to exploit it for their personal gain. This same type of rationale can be applied to the differences between telnet and SSH.

According to RFC854 (Telnet Protocol Specification) TELNET protocol was created to provide general, bi-direction communications between networked devices. These connections were eight-bit byte oriented. "its primary goal is to allow a standard method of interfacing terminal devices and terminal oriented processes to each other (RFC854).

That being said, one of the biggest downfalls of TELNET is that it is not really transparent at all. It has long been considered a security risk because user names, passwords, and all subsequent commands are transmitted as easily-exploitable plain text (Brenner, 2007). However, TELNET is really a useful tool. So what to do? We need to be able to have the same essential functionality, but with some level of security.

Enter SSH...

According to RFC4251, Secure Shell(SSH) is a protocol for secure remote login and other secure network services over an insecure network. There are three major components:

1. The Transport Layer Protocol [SSH-TRANS] (provides server authentication, confidentiality, and integrity)
2. The User Authentication Protocol [SSH-USERAUTH] (authenticates the client-side user to the server and runs over the transport layer protocol.
3. The Connection Protocol [SSH-CONNECT] (multiplexes the encrypted tunnel into several logical channels and runs over the user authentication protocol). (RFC4251).

So, as one can see, the service that SSH provides is essentially the same as one would use with TELNET; however, SSH offers a mode of communication that is much more secure. Meaning the bad guys cannot get your information as easily.

FTP v. SFTP

FTP (File Transfer Protocol) was created to promote sharing of files; to encourage indirect or implicit use of remote computers; to shield a user from variations in file storage systems among hosts; and to transfer data reliably and efficiently (RFC959). In layman terms, it is simply a protocol via which users can upload and download files from one networked resource to another.

Like with TELNET, FTP is unsecure. Whenever a user opens a regular FTP session using a TCP/IP connection, the entire transmission between the host and client is sent in plain text. Anyone who has the ability to snoop on the network packets can read the data, including the password information. If an unauthorized user can login, they have the opportunity to compromise the system (University of Kentucky).

SFTP was created to eliminate this issue. The purpose and functionality is essentially the same; however, the entire login session, including transmission of password, is encrypted. It is therefore much more difficult for an outsider to observe and collect passwords from a system using ssh/sftp sessions. Therefore, SFTP is a much more relevant transport protocol in this day and age of cyber-criminals.

References

Brenner, B. (February 16, 2007). Solaris flaw a reminder of why telnet is toast. Retrieved January 21, 2009, from http://searchsecurity.techtarget.com/news/column/0,294698,sid14_gci1244019,00.html

Postel, J. & Reynolds, J. (1983). RFC854 - Telnet protocol specification. Retrieved January 21, 2009, from http://www.faqs.org/rfcs/rfc854.html

Postel, J. & Reynolds, J. (1985). RFC959 - File transfer protocol. Retrieved January 21, 2009, from http://www.faqs.org/rfcs/rfc959.html

Lonvick, C. & Ylonen, T. (2006). RFC4251 - The secure shell (SSH) protocol architecture. Retrieved January 21, 2009, from http://www.faqs.org/rfcs/rfc4251.html

University of Kentucky: Center for Computational Sciences (n.d.). Secure file transfer. Retrieved January 21, 2009, from https://www.ccs.uky.edu/machines/sftp.html