Re: OpenSSH/scp ->> F-Secure SSH server Problems

[nisse%lysator.liu.se@localhost (Niels Möller)]

Thor Lancelot Simon <tls%rek.tjls.com@localhost> writes:

> But then again, I think that reinventing most of what TLS does for
> the SSHv2 transport layer instead of politely asking the TLS folks
> for a record-oriented interface was rather silly, too.

I've implemented both TLS (ok, it was actually SSL version 3 back
then) and ssh2. I'd say the ssh2 transport is better. It's cleaner,
more secure, more flexible, and its spec is a lot easier to
understand. And then a lot of the complexity in ssh is in the
connection layer, which isn't comparable to TLS in any way.

> Ergo, a small, lightweight SSH implementation, even one that did v2,
> might quite reasonably choose to *not* implement SFTP; to me, at least,
> it sure seems to bring very little to the table in return for a lot
> of increase in code size and maintenance.

The ssh implementation and the sftp implementation are quite
independent. They have a common origin and uses a common language and
terminology, but you can run the sftp over any secure bidirectional
connection. The only feature in the ssh core protocol that makes sftp
easier is the subsystem request that lets a client start a program
without knowing an exact path, and without knowing whether or not it
is an external program or part of the ssh server.

If I get involved in a complete sftp implementation, it will run just
as well using lsh, kerberized rsh, or plain old insecure rsh if
anybody is still using that.

Furthermore, the server part (i.e. the subsystem) is not big, I expect
the one I started to write to be a self contained program of at most
5000-10000 lines of C code. Say about twice as large as GNU ls. 

/Niels