|
|
 
Although Windows 2000 can be set up using proprietary (Well... MSified) secure connections via IPSec, there are a variety of problems. Most notable is the difficulty to get secure connections to work across multiple platforms, even between different Windows products. It is quite easy to create keys and pull files securely over the Internet from a central Linux server using Cygwin on the Windows box. Search for Cygwin at the top of this page for more info. (We have quite a few articles on Cygwin on NetAdminTools). To set up keys, on the client side (the Windows box), enter:
ssh-keygen -t dsa
Copy the .pub file to the Linux server. Create an account on the Linux server that has access to just the files you want the Windows client to have access to. Then, go into the home directory of that account and then into the .ssh directory (you may have to create it). Create a file called authorized_keys2 if it doesn't exist, and then cat your .pub key onto the bottom of the authorized_keys2 file on the linux server:
cat yourkey.pub >> authorized_keys2
You can test the security by trying to ssh in to the Linux box under the account you created:
ssh user@linuxbox.xx.com
You will be asked to add the host to the list of known hosts. Say yes, and you are in. The cool thing is that you can now pull updates from the central server:
scp user@linuxbox.xx.com:~/files/file.dat ./
Make a batch file and use the scheduler to run it every night, and you are all set. Be very careful about the security issues here. There are a lot of things to worry about, particularly on the server side of things. This is just a thumbnail sketch. Do pay attention to who can view your .ssh directory and your authorized_keys2 file. We do advise that you shut down every service you aren't using. If you are just using the Linux server as a file repository, then just run sshd, and only allow ssh traffic through your firewall to that box. Further, make sure you keep up with patches to ssh. The later versions of SSHD (OpenSSH at least) do check your permissions to some extent by default, and won't allow access if your permissions aren't restrictive enough. Don't rely on that, though. :)
|
|
