An SSH-based toolkit for user-based network services
Joyita Sikder, M. Radhakrishnan, Jon A. Solworth · 2009
Network authentication, even when using libraries intended to simplify the task, is inordinately difficult. Separate libraries are used for cryptography, network authentication protocols, accessing stored authentication information, and verifying the identity of remote entities. In addition, service used must be authorized. Finally, privilege separation is needed to separate security sensitive, highly privileged operations from the remainder of the application. These tasks consume thousands of lines of application source code (not counting the security libraries on which they rely), and require much specialized security knowledge from the application programmer and system administrator. In this paper we present a simple toolkit called sshUbns which encapsulates all these tasks in an easyto-use tool. We modified SSH to add in sshUbns (in addition to SSH’s other modes) and implemented a new super-server called unetd. It reduces to a negligible level the amount of application server security code needed. This toolkit makes it easier to create secure networking code, reduces security specific knowledge needed by application programmers, and makes it easier for system administrators to protect and analyze their systems. 1