Why do Internet connectable BBSes do not have SSH? reddit / bbs ---------------------------------------------------------------------- antdude · 2016-01-17 20:26 Why are they still using Telnet? :( Thank you in advance. :) ---------------------------------------------------------------------- RealDeuce · 2016-01-17 22:36 Synchronet supports SSH. ---------------------------------------------------------------------- PhotoJim99 · 2016-01-18 03:25 Telnet is lower bandwidth and more accessible by vintage hardware... that would be my guess as to why. ---------------------------------------------------------------------- recourse7 · 2016-01-18 03:36 I think its more likely that the devs don't want to do the work to support ssh. As /u/RealDeuce says Synchronet supports ssh. ---------------------------------------------------------------------- mro_1337 · 2016-01-18 04:35 why are you sadface because bbses use telnet? ---------------------------------------------------------------------- ebookit · 2016-01-18 04:54 I think OP just saw the WWIV 5.0 Github release and noticed there is no SSH support. I agree Synchronet is more advanced than WWIV and others. Deuce and others has done a lot of hard work on it. I used to run Synchronet and it even has a web server interface for HTML access to the BBS forums. I just didn't have enough users to keep it going so I shut it down. ---------------------------------------------------------------------- antdude · 2016-01-18 07:08 Telnet = Unencrypted ---------------------------------------------------------------------- RealDeuce · 2016-01-18 08:07 Also, telnet is a horrible protocol which is not 8-bit clean. ---------------------------------------------------------------------- RealDeuce · 2016-01-18 08:08 If the hardware is capable of a resonable internet connection, it's almost guaranteed to be capable of SSH. For the hardware that uses a front-end, that front-end hardware could run SSH as easily as it can run tel.net ---------------------------------------------------------------------- antdude · 2016-01-18 11:18 Not clean? ---------------------------------------------------------------------- antdude · 2016-01-18 11:18 Yep. ---------------------------------------------------------------------- PhotoJim99 · 2016-01-18 13:19 Depends on the age of the hardware. If modern, yes, I agree. But, for example, there are lots of ways of getting an Internet connection on a Commodore 64 (including Schema's wonderful new WiFi card) but none of them support ssh (although they do support telnet). ---------------------------------------------------------------------- NuSkooler · 2016-01-18 17:02 ENiGMA½ supports SSH (note: there are a couple bugs with some clients I'm still working out). This was one of the design goals up front as I'd really like to encourage security. There are a lot of issues though: * Lots of **ANSI-BBS** and similar terminals do not support SSH. For ANSI, there is SyncTERM and EtherTerm that I know of. And of course the standard *nix terminal if you have fonts, colors, etc. setup to make the graphical part not suck. * Older software: A lot of people like to run oldschool software (which is awesome!) but this does not come with SSH of course. I haven't looked into it much, but it really shouldn't be too hard to setup a SSH -> telnet -> the BBS proxy For ENiGMA½ I have built in "is secure" into the ACS system. For my own board, I plan on preventing users access to certain areas/etc. unless they switch to an SSH connection. Once they do this, they must not use Telnet again or risk losing the access (as they have then exposed their password/etc.) ---------------------------------------------------------------------- RealDeuce · 2016-01-18 20:38 Not only do you need to escape an octet with a value of 255, the telnet standards are written for 7-bit ascii. ---------------------------------------------------------------------- RealDeuce · 2016-01-18 20:45 > there are lots of ways of getting an Internet connection on a Commodore 64 but none of them support ssh. One way is to put a more modern system on the internet and pass it through to the C64 serial port... that method supports SSH. You can also do an SSH to telnet gateway pretty trivially. Anything that supports WiFi has the juice to support SSH... it still comes down to the developers just not being interested in doing it. ---------------------------------------------------------------------- PhotoJim99 · 2016-01-18 21:00 I telnet to a Linux bot on my LAN (on a LAN I control, telnetd is safe) and go from there. ---------------------------------------------------------------------- mauszozo · 2016-01-20 04:11 x/84 also supports SSH. I haven't checked all the others in the sidebar, but Synchronet, ENiGMA½ and x/84 makes three so far. ---------------------------------------------------------------------- mro_1337 · 2016-01-20 04:22 what are you doing on a bbs that you are worried about encryption? i never had a user's account compromised ---------------------------------------------------------------------- mro_1337 · 2016-01-20 04:23 that may be so, but we've learned to work with it and around with bbses since the 90s ---------------------------------------------------------------------- mro_1337 · 2016-01-20 04:26 i run a pretty established bbs and i have ssh on another port. and i advertise what port it's on. i havent really had any users call in using ssh much. is having ssh really worth it when users dont use it? ---------------------------------------------------------------------- antdude · 2016-01-20 06:25 SSH = Encrypted! ---------------------------------------------------------------------- cloverskull · 2016-01-20 18:08 Daydream supports any traditional styled sshd. The issue with ssh and a bbs is that unless you want to code your own special snowflake ssh daemon for your bbs, you've got to tie your bbs to a user that owns all the bbs files; potential for security issues. For example, if you don't turn off sftp or scp or any number of things (find a way to jail the user, etc) you're more or less hosed if someone wants to go muck around using standard ssh practices with ill intent. ---------------------------------------------------------------------- NuSkooler · 2016-01-20 19:28 This is the same argument that has been made against SSL/TLS in the past for HTTPS. In general, "users" don't care -- because they don't know why they should care. From your previous statement above, I think you're in the same boat. If your telnet connection loads up and says nothing more than: Disconnect and re-connect to port N with SSH, users will do that. That is, assuming it's something they can easily do. Right now, there are a limited set of clients that support both SSH and ANSI-BBS/similar. Plain text communication wasn't *as* such a bit deal back in the day using POTS. It's a huge deal now days going over the Internet via telnet. Your passwords, account information, private user-to-user communication, and so on are there for the grabbing. SSH/encryption is something that needs pushed hard for both connecting and inter-BBS communication (e.g. message area exchange). This is both a technical problem and a education problem. Educating people why they need SSH (or TLS on the web) is mostly a waste of time. You can however, educate them how to use them and it just becomes "how I do things". ---------------------------------------------------------------------- mro_1337 · 2016-01-22 00:40 i dont need to be educated on this. even if my user's passwords were compromise WHICH THEY NEVER HAVE BEEN IN THE 15 YEARS I HAVE BEEN ON THE INTERNET, it wouldnt matter. fuck ssh with bbsing. whatever works. ---------------------------------------------------------------------- mro_1337 · 2016-01-22 00:41 so what it's a bbs. nobody has anything to hide ---------------------------------------------------------------------- mro_1337 · 2016-01-22 00:41 "Telnet = Unencrypted" big deal ---------------------------------------------------------------------- mro_1337 · 2016-01-22 00:43 futhermore, if my bbs says 'connect with this instead' and drops the connection, they will NOT connect with another client on another port. they will just move on. you have no clue how people think. ---------------------------------------------------------------------- NuSkooler · 2016-01-22 03:28 > i dont need to be educated on this. even if my user's passwords were compromise WHICH THEY NEVER HAVE BEEN IN THE 15 YEARS I HAVE BEEN ON THE INTERNET, it wouldnt matter. This statement ironically proves the opposite of what it states. If you have something compelling on your BBS, people will absolutely connect to a different port via SSH. With client support, there is absolutely no difference in connecting to port A vs port B from a user perspective. This becomes even easier when the plain text telnet connection is allowed but provides less access/features. ---------------------------------------------------------------------- DarrylLeeS · 2016-01-23 00:58 I think you kind of nailed it here. the *If you have something compelling* statement which, i'm sorry to say, but for 99.99% of users - they're playing a text based game. Unless you were doing something *compelling* like perhaps, maybe distributing movie torrents or music, or something that might justify why you'd want people to have encrypted connections, otherwise as they say in InternetLand(tm).... NO1CURR ---------------------------------------------------------------------- mro_1337 · 2016-01-23 18:43 nuskooler that's the way you want it to be, not the way it is. most people behave exactly the way i said they do. i have many years of first hand knowledge. bbs users dont want hassle. they want uptime and they dont want to jump through hoops to get on a system. you dont know much about bbsing or the people that use bbses so you shouldnt attempt to speak for them. bbses compelling? dont make me laugh. and do you have any knowledge of a bbs system being compromised because they are telnet only? NO. furthermore, your own bbs runs on telnet telnet://xibalba.l33t.codes:44510 ---------------------------------------------------------------------- Paco_Smithereens · 2016-01-28 00:10 Your general idea of "practically, does this really matter" is not wrong. I think a lot of us are used to having ssh or otherwise secured connections "for free" in the apps we use regularly (Web, IRC, etc.), and telnet sticks out like a sore thumb. What client do most people use to connect to BBSes now? On Unix- likes, ssh is as easy as telnet. On Windows, telnet doesn't even look like it's available on a default install anymore (not on my Windows 10 machine). In that case, people could just as easily download PuTTY as they could a telnet client. What's left? Syncterm supports SSH. All things being equal, I'd prefer to use SSH. I don't know if they are equal. Does telnet-only drive people away from boards? Don't know. Does telnet-only prevent people from saying or doing things on boards they would ordinarily do? Don't know. Most of what makes a board a board is stuff that is public anyway. You're essentially posting public messages via an encrypted connection (unless there's this vast network of spies and terrorists and anarchists using BBS person-to-person e-mail features that I am unaware of). If I was going to snoop on what someone was doing, I'd be far more likely to just get an account on the system and read what someone wrote in a message, or what they uploaded. So I agree probably this is much ado about nothing, except for the fact that if people have to download a client to connect to a board, which increasingly they do, it's just as easy to download and use an ssh one as a telnet one. ---------------------------------------------------------------------- peter_tonoli · 2016-01-28 03:01 Actually, the compression support in SSH means that it's lower in bandwidth usage than telnet ---------------------------------------------------------------------- PhotoJim99 · 2016-01-28 03:32 If you use compression, yes, that's true, although vintage hardware has no chance of keeping up with real-time compression. v.42bis in a modem is doable, but Blowfish e.g. would bring vintage hardware to its knees. ---------------------------------------------------------------------- NuSkooler · 2016-01-28 04:22 I (don't think) anyone will be implementing and/or using SSH on vintage hardware, so I doubt this is a issue. For vintage, I'd set up a SSH proxy where the SSH side is on newer hardware and the vintage side only does telnet at the most. ---------------------------------------------------------------------- NuSkooler · 2016-01-29 21:03 https://en.wikipedia.org/wiki/Nothing_to_hide_argument ---------------------------------------------------------------------- mro_1337 · 2016-01-30 21:03 not going to click that. dont care enough ---------------------------------------------------------------------- mro_1337 · 2016-01-30 21:09 also, do we have a web client that is ssh compatible? more regular users are becoming familiar with ftelnet and flashterm which eliminate the need to use a client. would be nice to have a ssh html5 client. syncterm is fine for ssh, i'm not sure most people use it for that, though. also putty can't handle ansi-bbs very well. i just go by what i know and what i've seen. i've ran bbses for very long and i have real people calling my bbses, just not other sysops like most synchronet and mysticbbs bbses. i've probably had 2 people ask me about ssh on my bbs in the past 15 years. what i know is most people use telnet instead of the other options i have available. i'm pretty sure if you asked everyone with an active board that stays up they'd say the same. ---------------------------------------------------------------------- NuSkooler · 2016-02-02 01:36 fTelnet already supports SSH via Secure WebSocket (wss://). Since it's wss:// you must convince the browser to trust the connection (e.g. have a CA installed) but this is easy now with things like Let's Encrypt and others giving out free SSL certs. ---------------------------------------------------------------------- theofficialdeavmi · 2016-05-22 06:25 Is a big deal ---------------------------------------------------------------------- theofficialdeavmi · 2016-05-22 06:25 You could tho