Using SSH Protocols to Work with Servers Part 1 - Windows Users

[Grogan]

The usage of traditional services, like telnet and ftp, to work on or transfer content to servers should be avoided. The reason is that these services use plain text, and passwords and data can be stolen by miscreants using IP sniffing techniques.

Instead, encrypted SSH protocols should be used for command line administration, and for transferring files. Most Windows servers won't likely have SSH capabilities, but most all Unix/Linux servers will. So if your Web hosting directory resides on a Unix or Linux server, there's no excuse for using plain text services to administer your site. Especially when there is Free Software available, for both Windows and 'Nix platforms.

We will cover Windows clients first, in this part of the tutorial. First of all, you need to obtain some software.

PuTTY

This is a free Secure Shell (SSH) client for Windows, licensed under the MIT License. This is recommended for logging on to your shell account if you wish to remotely administer your site from the command line. (knowledge of Unix commands is required)

This is the official Web site, where you can read more about it and download it:
http://www.chiark.greenend.org.uk/~sgtatham/putty/

WinSCP

This is a "Secure Copy" (SCP) and "Secure FTP" (SFTP) client for Windows. This is recommended for uploading files to your Web space, because it uses encryption to prevent theft of data and passwords in transmission. It is very easy to operate, and behaves much like a two paned file manager with the local system in the left pane, and the remote system (server) on the right. No arcane knowledge is required. It is Free Software, licensed under the GNU General Public Licence. (GPL)

This is the official Web site, where you can read more about it and download it:
http://winscp.net/eng/index.php

Secure Shell

PuTTY is a standalone program and no installation is required. Simply double click putty.exe to launch the client. You may also create a shortcut to the program if desired.

The first thing you will see is the login and configuration screen:

http://www.bitbenderforums.com/~grogan/sshhowto/01_putty.jpg

You can either use the server's IP address, or its host name (e.g. yourdomain.com or www.yourdomain.com). You want to use port 22, and the SSH protocol.

While PuTTY won't save the username and password for you, I would recommend that you save a session so that you don't have to enter the host name every time, and so that it will retain your font settings. I like to use Fixedsys in Windows, but choose one that suits your tastes if you don't like the default.

http://www.bitbenderforums.com/~grogan/sshhowto/02_putty.jpg

Once you have entered the host name and changed your font settings (there are many other advanced settings that you shouldn't need to worry about), go back to Session in the left pane of the configuration dialog, type a name in the Saved Sessions field, and click Save. I chose "My Server" but it can be anything you want.

http://www.bitbenderforums.com/~grogan/sshhowto/03_putty.jpg

Once you've saved a session, you can highlight and click Open, or simply double click it to launch the connection.

The first thing you will see when connecting to a server with SSH for the first time, is a prompt to save the server's key. Say Yes.

http://www.bitbenderforums.com/~grogan/sshhowto/04_putty.jpg

Once you connect, a terminal window will open where you are prompted for your username, then prompted for the password.

http://www.bitbenderforums.com/~grogan/sshhowto/05_putty.gif

You can click on the edges of this terminal window, and drag it larger. Once you are finished what you set out to do, type logout to log off the shell, break the connection and terminate the putty program.

Even if you aren't Unix savvy and couldn't be bothered to learn how to use a shell account, there is still one useful thing you may wish to do. It's an easy way (and sometimes the only way) for a user to safely change their own password. To do this on 'Nix systems, you use the passwd command:

http://www.bitbenderforums.com/~grogan/sshhowto/05_puttypasswd.gif

The passwd command first prompts for the old password, then prompts for the new, and prompts for the new again to confirm your typing. The password change takes effect immediately, so any new logins must use the new password.

Another useful command is the chmod command for changing permissions. Note the "rw-------" permissions on the index.html file in the image below. That won't do, for people would just get a 403 Forbidden error message from the Web server when attempting to access your site.

http://www.bitbenderforums.com/~grogan/sshhowto/05_puttychmod.gif

With the command chmod 644 index.html I change permissions so that everyone has read access to the file. The only user with write access is the owner (you). After changing permissions, the file is shown with rw-r--r-- permissions.

See Here (en.wikipedia.org/wiki/Permissions#Traditional_Unix_permissions) for a discussion of Unix permissions, but what you mainly need to know for Web hosting purposes is that directories must be "rwxr-xr-x" and files must be "rw-r--r--". The respective commands to do that are:

chmod 755 directoryname
chmod 644 filename

When you are finished with your shell session, type the logout command.

[Grogan]

WinSCP either comes as an installer, or as a standalone program. If you downloaded the installer, double click it to install the software. It will create icons, start menu shortcuts, optional shell extensions, and an uninstall entry in add/remove programs. If you downloaded the standalone executable, simply double click to run it, or create a shortcut if desired.

Just like with PuTTY, the first thing you will see when you open WinSCP is a login and configuration dialog.

http://www.bitbenderforums.com/~grogan/sshhowto/06_winscp.jpg

Enter the IP address or hostname, your username and password and leave the Protocol set to "SFTP (Allow SCP Fallback)"

At this point, once you have entered this information, you may click the Login button, but first you might want to set a few options like the initial local and remote directories, and click Save to save your session. Note that you do not need to save the password. The program will prompt you for it. If you have others accessing your PC, you probably should not save the password with the session.

To set the initial directories, click on Directories under Environment, in the left pane:

http://www.bitbenderforums.com/~grogan/sshhowto/07_winscp.jpg

You may wish to set the initial remote directory to your Web root directory, for example, public_html. In other words, the top directory where you are to transfer your Web content.

To set the initial local directory, you may click the rectangular button to browse for the location. Once you have done that and chosen a directory, the path will be shown in the Local directory field.

Note that the directory slashes for the remote server are Unix style backslashes. The server is running the Linux operating system. On your local computer (if using Windows, which you probably are if you're reading about WinSCP) the directory slashes are DOS/Windows style forward slashes. Windows also uses drive letters. Unix does not.

Once you are finished, click the Save button, to save your session.

http://www.bitbenderforums.com/~grogan/sshhowto/08_winscp.jpg

You can't miss that stern warning. Heed it, if you are not the only user of the workstation.

You will then be prompted to give the session a name. Anything will do, you don't have to use the default.

http://www.bitbenderforums.com/~grogan/sshhowto/09_winscp.jpg

You will then see your stored session. Every time you open the program, this will now be the first screen you will see and you can quickly connect.

http://www.bitbenderforums.com/~grogan/sshhowto/10_winscp.jpg

You can simply double click on your stored session, or highlight it and click Login.

Just like with PuTTY, connecting with SSH for the first time will prompt to store the server's key. Say Yes.

http://www.bitbenderforums.com/~grogan/sshhowto/11_winscp.jpg

Now, if you've set your initial directories before saving the session, you will automatically be in the desired place when you first log on.

http://www.bitbenderforums.com/~grogan/sshhowto/12_winscp.jpg

Don't let all those buttons, icons and doohickeys intimidate you. This program is very easy to operate. If you wish to see what the buttons do, hover over them for a tool tip. Some you will want to think carefully about before using, for example buttons to synchronize directories. Most people will only do basic navigation and file transfers with this program, but it doesn't hurt to know your options. If you click a button, you'll be prompted for any action.

You can transfer files, or entire directories (folders) from either side. Click on a file or directory that you wish to transfer. I browsed for my "sshhowto" folder on the local side, and selected it.

http://www.bitbenderforums.com/~grogan/sshhowto/13_winscp.jpg

Clicking on a file or folder does indeed select it, but this program is strange in that it doesn't highlight it. It just draws a rectangle around it. The sshhowto folder is selected, and can be transferred. Note that if you use the ctrl or shift keys while you click to select multiple files, they will all be highlighted like you would expect them to.

Select the files or folders you wish to transfer, and either press the F5 key, or click "F5 Copy" down on the toolbar near the bottom of the program window.

http://www.bitbenderforums.com/~grogan/sshhowto/14_winscp.jpg

You will be prompted for action. Note that the path in the field is highlighted, so be careful not to press a key or you will erase it. If this happens, just click cancel and try again.

You can see that the folder has been transferred to the remote server.

http://www.bitbenderforums.com/~grogan/sshhowto/15_winscp.jpg

If the server is configured correctly with a sane "umask" setting for file creation, files should be created with the desired permissions for public Web hosting by default. If the default isn't what you want, then you must change them.

Note the permissions ("rights") for the sshhowto directory:

rwxr-xr-x

Unix permissions use 3 sets of permissions for the owner, group and everyone else. The first set of 3 "rwx" is for the owner (you), who has read, write and execute permissions. For directories, the execute permission effectively means the ability to enter the directory. The next set of 3 "r-x"is for the group ownership that is assigned to the directory. The third set "r-x" is for everyone else. Note the absence of the w. The directory should not be writable to anyone but the owner.

For the directory and files within to be accessible on the Web, everyone ("others") must have read and execute permissions on the directory.

If you right click on a file or directory in the remote server pane of WinSCP and view Properties, you will see an interface to change permissions using check boxes. This is what it would look like, for the sshhowto directory to be rwxr-xr-x

http://www.bitbenderforums.com/~grogan/sshhowto/16_winscp.jpg

This is the very same as using the octal value "755" (at the command line, that would be chmod 755 sshuser)

Now, note the permissions on the file, index.html:

rw-r--r--

Most files and Web scripts do not need the executable bit set, for they aren't executed on their own, but by an interpreter. The owner has read and write permissions, the group has read permissions and everyone else has read permissions. It is necessary for everyone to have read permissions on this file.

This is what rw-r--r-- looks like when you view properties of a file on the remote side with WinSCP:

http://www.bitbenderforums.com/~grogan/sshhowto/17_winscp.jpg

This is the very same as the octal value "644" (at the command line, that would be chmod 644 index.html)

That's pretty much all there is to using this program to transfer files to a Web server. When you are finished, press the F10 key, or click the F10 Quit button at the right of the toolbar near the bottom of the program window.

http://www.bitbenderforums.com/~grogan/sshhowto/18_winscp.jpg

You will be prompted to terminate the session and exit the program. If you like, you can eliminate that step by checking the "never ask me again" box.

[Grogan]

Please See

Using SSH Protocols to Work with Servers Part 2 - Linux Users