This article mainly introduces the communication principles of Telnet and SSH, and analyzes their working flow during communication.

1. Telnet

No matter what type of terminal a Telnet protocol connection uses, communication is converted to NVT (Net Virtual Terminal) format. The Network Virtual Terminal, NVT, is the foundation of Telnet’s heterogeneous, cross-platform nature.

1.1 How Telnet Works

1. The local host establishes a connection with the remote host. This process is really just establishing a TCP connection; the user must know the remote host’s IP address or domain name.

2. The username and password entered on the local terminal, along with any commands or characters entered afterward, are transmitted to the remote host in NVT format. This process is really sending an IP datagram from the local host to the remote host.

3. The NVT-formatted data output by the remote host is converted into a format the local side accepts and sent back to the local terminal, including the echo of the entered commands and the results of command execution.

4. Finally, the local terminal tears down the TCP connection to the remote host.

Here, the data exchanged between the Telnet client and server is all in plaintext. Packet capture tools can easily obtain this data and use it to attack network devices.

1.2 Common Telnet Attack Methods

1. Password theft: stealing the user’s account and password by means such as packet capture.

2. Man-in-the-middle attack: the “man in the middle” impersonates the real server to receive the data the client sends to the server, then impersonates you to pass that data on to the real server.

3. Fake server: the attacker impersonates the server and interacts with the client to trick the client into revealing its account information.

2. SSH, Secure Shell

Encrypt all transmitted data, so that a man-in-the-middle attack becomes impossible, and DNS and IP spoofing can also be prevented — that is SSH.

3. The SSH Login Process

1. Version negotiation. The server opens port 22 and waits for a client connection; once connected, the server and client negotiate the protocol version.

2. Key and algorithm negotiation phase. The server and client each send algorithm negotiation packets to the other; the packets contain the list of algorithms supported for each protocol. Based on the negotiation, the server and client select the algorithms to use. Using the DH exchange algorithm, host key pairs, and other parameters, the server and client generate a session key and a session ID.

3. Authentication phase. The client uses the session key generated in the key and algorithm negotiation phase to encrypt the account, authentication method, and password, and sends the result to the server. The server uses the obtained session key to decrypt the packet, recover the account and password, and perform authentication. SSH provides two authentication methods (version 2.0 also supports password-publickey and any authentication):

   • Password authentication. The client encrypts the username and password and sends them to the server; the server decrypts them and compares them for authentication.
   • Digital signature authentication. The device uses the RSA or DSA public-key algorithm to implement a digital signature, generating a public key and a private key, then uploads the public key to the server. During login authentication, the server sends a random string to the client; the user encrypts it with their own private key and sends it back. The server decrypts and authenticates it using the stored public key.

Further reading: SSH Principles and Applications (Part 1): Remote Login