Is SSH really necessary? reddit / bbs ---------------------------------------------------------------------- garyb122 · 2021-11-04 04:14 I absolutely give up on trying to get SSH working on my BBS. I can’t do it. Which led me to think… Is SSH really necessary? I can’t speak for everyone, but I know that on my BBS we don’t sell Pentagon secrets. There’s no files on my BBS that tell who really shot JFK. Nothing shocking at all. Just a few middle-age men playing Tradewars. Does that sound like the kind of thing you’d need an encrypted connection for? I’d be curious to know the telnet/SSH connection ratio on other boards. I’m betting it’s less than 20% SSH connections. Thoughts? ---------------------------------------------------------------------- mixedliquor · 2021-11-04 10:20 I don’t think I’ve ever used SSH for a BBS. ---------------------------------------------------------------------- Duckula-MBBS · 2021-11-04 10:49 The primary reason to use it is to protect login details in transit. Telnet is clear text so when you enter your password it could be intercepted. If you use the same password for other sites/services then there is a risk. The transmission of Tradewars data over SSH is obviously not necessary 😀 ---------------------------------------------------------------------- WWIVPENGUIN · 2021-11-04 11:00 I don't think it is. As long as your users aren't using the same password for your BBS and bank. I support it, but pretty sure it's never used, I have a web interface that gets the most use and telnet for the rest. bbs.stardoc134.com ---------------------------------------------------------------------- Android8675 · 2021-11-04 14:43 I use ssh for all Synchronet boards. The Internet these days, you never know and being able to pass your credentials makes it easier. It's really no different than connecting via telnet. mostly. ---------------------------------------------------------------------- denzuko · 2021-11-04 17:34 Oh, it's not about "pentagon secrets" or encryption on the wire. Been in infosec for ages and can tell you this if your box is compromised then your on the line legally for all the malware, phishing, piracy, kiddy porn, and crypto that comes from it and it will. If one has to use telnet then put it behind cloudflare (block all USA and United Nations Security Council sanctioned countries) \*and\* haproxy. Then setup fail2ban or threatstop to monitor for telnet activity and null route the failed activity. Same goes for ssh since both ports are under constant heavy automated attacks.Some config examples to help get you going: [http://darkgame.buanzo.org/mystic/](http://darkgame.buanzo.org/mystic /) Also, using haproxy allows one to setup letsencrypt and enable telnet- ssl. Yes ssl telnet has been a thing since before ssh; ssh just got more popular because of scripting and US encryption laws of the time which no longer apply. ---------------------------------------------------------------------- 3G6A5W338E · 2021-11-04 18:27 Plaintext vs not. What I don't get is why telnet-ssl isn't used instead. ---------------------------------------------------------------------- revicon · 2021-11-04 20:30 You're having your users send their passwords as cleartext over the open internet? What happens if they use that same password for their gmail or their bank account? (huge percentages of internet users use the same password everywhere they can). This is less about someone hacking your tradewars instance and much more about being a responsible sysop. Gone are the dial up days of yore where you were a standalone system, now we've all got a responsibility to the collective internet. ---------------------------------------------------------------------- [deleted] · 2021-11-04 21:38 Honestly, yes. It's about the passwords. People tend to reuse passwords, and most BBS systems don't have good password requirements - the passwords are short, can't have symbols, etc. SyncTERM and others support Telnet, Telnet with SSL and SSH. You should at least use and enforce Telnet-SSL and/or SSH. ---------------------------------------------------------------------- TheLimpingNinja · 2021-11-05 00:42 Everyone will ack. that passwords are the reason. I think the option is something that is absolutely good to have and in an ideal world should be the default, but often won’t be used due to poor clients and the option to fallback bbs’ retain. Most MUDs and BBS’ don’t want to limit their already superbly limited client pool by disabling plaintext. Unpopular opinion follows: Dunps of passwords from MUDs and BBS’ just do not really happen and if it does they are likely so insanely unprofitable that they aren’t worth the time to scrape. “If their bbs password is the same as their bank and gmail and…”; this is highly unlikely and fixed with a message above password creation. The percentage of users that will listen to that is likely higher then the percentage opting for ssl. ---------------------------------------------------------------------- antdude · 2021-11-08 01:34 Yes, for security and privacy. ---------------------------------------------------------------------- RolandMT32 · 2021-11-17 22:09 I don't think it's necessary. I've occasionally had some users use SSH on my BBS, but most users connect with telnet. That said, I'd think more people would want to use SSH (and encrypted protocols in general). Telnet sends everything (including a user's password) in plaintext. Many people would probably say they don't care, but even if you feel like you have nothing to hide, would you really want to give out your passwords? ---------------------------------------------------------------------- RolandMT32 · 2021-11-17 22:10 Most users probably don't really care though. If you disable the insecure protocols and only allow SSH on the terminal server, you'd see a significant dropoff in callers. ---------------------------------------------------------------------- nhaines · 2021-11-19 02:43 What about the TW2002 CIS data though? ---------------------------------------------------------------------- Duckula-MBBS · 2021-11-19 06:50 You got me 😂 ---------------------------------------------------------------------- kevinb361 · 2022-01-29 07:08 If SSH is available, heck yes.. not to mention once login/pw is saved in Syncterm, etc. I never have to enter them again =P ---------------------------------------------------------------------- Kahless_2K · 2022-10-03 15:20 I would file that under "their problem" Their password is far more likley to be exposed in a large breach than sniffed over the wire anyway if that is their user behavior.