How do I configure SSH2 in MacSecSH ?
I did not write (yet?) any manual for this software, but here's some help (you can also find some more help from The Ohio State University server, at this location: Using MacSecSH)
- key pair:
To create your key pair, go to the Favorites settings (Menu "Favorites", option "Edit Favorites
"), click on "Change", and in the SSH2 tab, click "Initialize SSH". This is to be done only once for all SSH2 connections, and creates a couple of files named "identity" and "identity.pub" in the same folder as MacSecSH.
identity is your private key file. don't give it to anyone.
identity.pub is the corresponding public key, which you give to SSH2 admins whose servers require a public key to accept connections.
If you intend to connect to OpenSSH/SSH2 servers using public key userauth, you will have to convert your public key to OpenSSH/SSH2 format by clicking on "Export public key
" and send the resulting file to the admin.
- Client configuration:
In the Favorites settings, tab SSH2, select the Encryption, Authentication and Compression methods to use, and, for a first connection to a host, leave the "Never trust unknown host key" unchecked. this will let MacSecSH accept new keys from the SSH2 host you connect to. In the Favorites settings, tab Security, Select the Protocol ssh2 (Secure Shell), and enter your login (mandatory). You can leave the password blank if you don't want to save it in MacSecSH preferences, it will be asked later. You should now be able to connect to the host.
- TCP Port Forwarding:
Duplicate the Favorite you want to connect to for port forwarding (or create a new favorite from scratch configured for SSH2), and in the SSH2 tab, select either Local or Remote TCP Port forwarding as Method. Enter the Local Port number, the Remote Host Name and the Remote Port Number, where Local Port number is the port number you want to use on your Mac as listener, and (Remote Host Name, Remote Port Number), the target service you want to use. Connect this session. You should then be able to use your favorite app connected on 127.0.0.1:localport, tunnelled via MacSecSH to the SSH2 server, itself connected (unencrypted, this time) to remotehost:remoteport. Note that 'remote host' is generally the same host as the SSH2 server you're connected to, or close to it. If you want to know more about this feature, I highly recommend lsh documentation from the current lsh archive /doc/lsh.html file.
- Troubleshooting:
If you have problems to connect to a host, you can activate the verbose/debug/trace modes from the SSH2 tab, leave the terminal window opened, by checking the "Windows don't go away" box in the Preferences dialog, and type Cmd-' (single quote) to open the console window. The connection traces will be displayed in this window.
The connection fails with message "do_zlib: inflate() failed: unknown compression method"
Select either "zlib" or "none" for the compression method in the SSH2 tab, but not "all in order".
The connection dies without any error message
Try forcing the authentication to either "SHA1" or "MD5".
When I open a second forwarded session on the same local port, MacSecSH displays "lsh: Invalid argument, (errno = 22)"
Once a local port is forwarded, it is is no longer available for any other listener on the local host.
But you can still open as many connections a you want from this port.
It is sloooow, can't you do anything to make it faster ?
In the main preferences dialog, set the TimeSlice to 0.
I've changed the Terminal colors to white on black, but the bold text is still displayed in black.
In the main preferences dialog, click on 'ANSI Colors' and select a color other than black.
How can I use different key-pairs for different hosts ?
You'll need to rename your keys, for instance identityX and identityX.pub, and add the option:
-i identityX
in the 'Command' field of the security tab.
Will you add SSH1 support ?
I'm afraid no. I used lsh because I found it the easiest to port, but it is based on the new SSH2 standard only.
I could not find any sources for SSH1 already ported to the MacOS. NiftyTelnet is not OpenSource, and
the SSH1 version of BetterTelnet is not available as source-code.
Anyway, there is already a free and excellent SSH1 client for MacOS, NiftyTelnet, written by By Jonas Walldén.
Will you add SFTP support ?
well, I would love to, especially since I already wrote quite some file-transfer apps for the Mac. The user interface doesn't really frightens me, but...
there's no sftp client yet in lsh.
If you want to contribute, you're welcome !
Where can I get the sources of MacSecSH ?
you can download the full sources archive (about 6 MBytes) at www.lysator.liu.se either using http or using ftp
note that you'll need Metrowerks CodeWarrior Pro 6 to compile all the projects.