Introduction

PenguiNet is an advanced SSH1, SSH2, SCP and Telnet client from Silicon Circus for Microsoft ® Windows® 95/98/ME/NT4/2000/XP.

Check out the features section to see what's new in this release. See the installation page for system requirements and installation guide.

Purchasing:

If you wish to continue using PenguiNet after 30 days, please purchase a keyfile from our online store.

If you would like information about site and campus licensing conditions, please contact sales@siliconcircus.com.

This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit. (http://www.openssl.org/)"


Installation

 System Requirements:

Microsoft ® Windows® 95/98/ME/NT4/2000/XP
If you are running Microsoft® Windows® 95, the Winsock 2 update is required.
If you are running Microsoft® Windows® NT, a minimum of Service Pack 3 is required.

PenguiNet requires approximately 2.5Mb of hard drive space.

Installation:

  • Download the archive from Silicon Circus.
  • Double click on the archive to begin setup.
  • Follow the on-screen instructions.

N.B. If you wish to move your installation of PenguiNet to a new client machine, you must re-run the setup. If you wish to retain your configured profiles, simply copy the profiles.pnt file into the directory containing PenguiNet.exe on the new machine. Please note, SSH keys are stored in the registry, so if you move your profiles file to a new machine, on connection to the hosts listed there you will need to re-verify the SSH keys.


Features

 Features:

New Features:

  • SSH2 support
  • Improved SCP support (Recursive transfers and other enhancements)
  • Task bar to help tracking sessions
  • Shortcut access to profiles
  • Auto-profile inheritance
  • Dockable toolbars
  • Colour schemes
  • Default window sizing options
  • Dynamic/On-the-fly font changing
  • GUI enhancements
  • Unix-format key compatibility
  • Double/Triple click to select word/line
  • Lots of bug fixes.

Existing Features:

  • Full VT100 and VT102 emulation.
  • Full Linux terminal emulation.
  • Support for Linux colours.
  • Secure Shell (SSH1) connections.
  • SSH port forwarding.
  • RSA identities, allowing for secure authentication.
  • Multiple connection windows, either in MDI or (emulated) SDI mode.
  • User definable "Connection profiles", each with inherited or individual preferences.
  • Supports NAWS, allowing remote applications to be resized in realtime.
  • Scores 100+4 out of a possible 100+10 in vttest.
  • Auto-update when new releases are available.
  • SCP capability.
  • Exclusive remote file browser.
  • Support for SOCKS 4/5 proxy servers.
  • Major speed increases in terminal emulation.
  • Minimise to system tray capability.
  • Context-sensitive help.


 Support

For support problems, please visit the PenguiNet homepage.

You can also visit the PenguiNet forums and post questions there. These forums are monitored by Silicon Circus staff on a regular basis.


License

Silicon Circus Ltd. IS WILLING TO LICENSE THE PenguiNet SOFTWARE TO
YOU ONLY UPON THE CONDITION THAT YOU ACCEPT ALL OF THE
TERMS CONTAINED IN THIS LICENSE AGREEMENT. READ THE TERMS
AND CONDITIONS OF THIS LICENSE CAREFULLY.

1. License to Use for purpose of evaluation and testing.

You are granted a non-exclusive and non-transferable license ("License") for
the use of the accompanying binary software in machine-readable form,
together with accompanying documentation ("the Software"), for the purpose
of evaluating and ensuring the functionality of the Software.  The period of
this License shall be 30 days from the date of the first installation of the
Software.  Upon expiration of this evaluation period, you may either choose to
obtain an identifying file ("keyfile") from Silicon Circus Ltd., or to destroy
any and all copies of the Software in your posession.  Upon obtaining a
keyfile from Silicon Circus Ltd., this License shall be extended indefinitely,
subject to Termination under any other clause of this License.  Should you
choose to destroy all copies of the Software in your posession, this License
shall Terminate as in clause 8 below.

2. License to Distribute.

You are granted a non-exclusive and non-transferable license (unless
specifically limited by other restrictions in this Agreement) to copy and
distribute the Software in a manner consistent with your obligations to protect
Silicon Circus' intellectual property rights hereunder.

3. Keyfiles.

Silicon Circus Ltd. may, at its discretion, make available to you an identifying
file ("keyfile"), to be recognised by the Software, and to consequently modify
the software's behaviour.  Any such keyfile is hereby explicitly excluded from
the above License to Distribute.  You may not make any copy of any keyfile
given to you, for any reason other than to provide an appropriate backup of
the Software.  In any event, distribution of any keyfile will result in both
revocation of that keyfile and in termination of this license.

4. Restrictions.

The Software is copyrighted and Silicon Circus Ltd. and/or its licensors
retain title to all copies. No license, right, title, or interest in any
Silicon Circus trademark, trade name, trade dress, design patent or service
mark is granted hereunder.  You shall not remove, obliterate or cancel from
view any copyright, trademark, patent or other proprietary rights notice
appearing on or embedded in the Software. You shall reproduce the same on
all copies of the Software (in any form), whether such copies are in whole
or in part. Unless applicable law prohibits the enforcement of this provision,
you shall not modify, decompile, disassemble, decrypt, extract, or otherwise
reverse engineer the Software.

5. Disclaimer of Warranty.

THE SOFTWARE IS PROVIDED "AS IS" AND Silicon Circus Ltd. DISCLAIMS
ALL WARRANTIES AND REPRESENTATIONS, WHETHER EXPRESS OR
IMPLIED, WITH RESPECT TO THE SOFTWARE INCLUDING, BUT NOT
LIMITED TO, THE WARRANTIES OF DESIGN, MERCHANTABILITY OR
FITNESS FOR A PARTICULAR PURPOSE, WARRANTIES ARISING FROM
A COURSE OF DEALING, USAGE OR TRADE PRACTICE, OR
WARRANTIES CONCERNING THE NON-INFRINGEMENT OF THIRD
PARTY RIGHTS.

6. High Risk Activities.

The Software may contain errors and is not designed or intended for use in on-
line facilities, aircraft navigation or communications systems, air traffic control,
direct life support machines or weapons systems ("High Risk Activities") in
which the failure of the Software would lead directly to death, personal
injury or severe physical or environmental damage.  You represent and warrant
to Silicon Circus Ltd. that you will not use or distribute the Software for
High Risk Activities.

7. Limitation of Liability.

IN NO EVENT WILL Silicon Circus Ltd. BE LIABLE FOR ANY LOST
REVENUE, PROFIT OR DATA, OR FOR SPECIAL, INDIRECT,
CONSEQUENTIAL, INCIDENTAL OR PUNITIVE DAMAGES HOWEVER
CAUSED AND REGARDLESS OF THEORY OF LIABILITY ARISING OUT OF
THE USE OF OR INABILITY TO USE SOFTWARE, EVEN IF Silicon Circus
Ltd. HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. The
foregoing limitations shall apply even if the above stated warranty fails of its
essential purpose.

8. Termination.

Subject to the conditions in item 1 above, this License is effective until
terminated. You may terminate this License at any time by destroying all
copies of the Software held by you, including any documentation.  This
License will terminate immediately without notice from Silicon Circus Ltd.
if you fail to comply with any provision of this License. Upon termination,
you must destroy all copies of the Software.

9. Governing Law.

This Agreement is made under, shall be governed by and construed in
accordance with the laws of England and Wales.

10. Severability.

If any of the above provisions are held to be in violation of applicable law, void,
or unenforceable in any jurisdiction, then such provisions are herewith waived
to the extent necessary for the License to be otherwise enforceable in such
jurisdiction.  However, if in the opinion of Silicon Circus Ltd.'s deletion of any
provisions of the License by operation of this paragraph unreasonably
compromises the rights or liabilities of Silicon Circus Ltd. or its licensors,
Silicon Circus Ltd. reserves the right to terminate the License as your sole and
exclusive remedy.

11. Integration.

This Agreement is the entire agreement between you and Silicon Circus Ltd.
relating to Software and: (i) supersedes all prior or contemporaneous oral or
written communications, proposals and representations with respect to its
subject matter; and (ii) prevails over any conflicting or additional terms of
any quote, order, acknowledgement, or similar communication between the
parties during the term of this Agreement. No modification to this Agreement
will be binding, unless in writing and signed by a duly authorised
representative of each party.

=============================================================

OpenSSL license

Copyright remains Eric Young's, and as such any Copyright notices in
the code are not to be removed.
If this package is used in a product, Eric Young should be given attribution
as the author of that the SSL library.  This can be in the form of a textual
message at program startup or in documentation (online or textual) provided
with the package.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the copyright
   notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
   notice, this list of conditions and the following disclaimer in the
   documentation and/or other materials provided with the distribution.
3. All advertising materials mentioning features or use of this software
   must display the following acknowledgement:
   This product includes software developed by Eric Young (eay@cryptsoft.com)

THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO
EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY
DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
OF SUCH DAMAGE.

=============================================================

 Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.

 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions
 are met:

 1. Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.

 2. Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in
    the documentation and/or other materials provided with the
    distribution.

 3. All advertising materials mentioning features or use of this
    software must display the following acknowledgment:
    "This product includes software developed by the OpenSSL Project
    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"

 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
    endorse or promote products derived from this software without
    prior written permission. For written permission, please contact
    openssl-core@openssl.org.

 5. Products derived from this software may not be called "OpenSSL"
    nor may "OpenSSL" appear in their names without prior written
    permission of the OpenSSL Project.

 6. Redistributions of any form whatsoever must retain the following
    acknowledgment:
    "This product includes software developed by the OpenSSL Project
    for use in the OpenSSL Toolkit (http://www.openssl.org/)"

 THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 OF THE POSSIBILITY OF SUCH DAMAGE.


 Credits

Programmer - Jon Bright
Producer - Matt Newton-Lewis
Webmaster - Ben Preece
Documentation - James Gurney

Special thanks to:

Oliver Wagner
Troels Wasted Hansen
Jörg Kühlen
Simone Tellini
Lee Harker
Mike Fitzgerald
Sarah Gurney
Thomas Hurst
Bart King
Holger Rabbach


 Getting started

When you run PenguiNet for the first time, you'll be presented with the profiles window. From here, you can configure hosts which you connect to on a regular basis. See the Connection profiles chapter for details on this configuration.

In the following pages, you can read about:

  • Navigating the GUI
  • Quick connect
  • The session window


 Navigating the GUI

PenguiNet has 3 bars enabled by default. The menu bar, the toolbar and the window switching bar. The toolbar and window switching bar can both be disabled through the View menu option.

The toolbar enables shortcut access to various pieces of functionality. These icons do the following (from left to right):

  • - Launches the Profiles window, allowing you to edit and connect to profiles
  • - Displays a tree view of your profiles to allow quick connection. This tree is visible in the screenshot above.
  • - Opens the Quick connect window.
  • - Disconnects the currently active session
  • - Copies the currently selected text
  • - Pastes the contents of the clipboard to the active session
  • - Copies and pastes the selected text at the same time
  • - Launches the Options window
  • - Launches this help file

The window switching bar appears (by default) at the bottom of the PenguiNet window, and works in much the same way as the Windows task bar. Active sessions appear on this bar and you can click on each entry on the bar to display that session window. Sessions can also be minimised to this bar.

The menu and toolbar can be moved to any side of the application window by simply dragging and dropping to the new location. Click the raised "handle" which appears at the far left of each bar by default to enable dragging. The window switching bar can only be positioned at the top or the bottom of the application. This is also achieved by dragging and dropping.


 Quick connect

If you just need to make a quick connection to a host without creating a profile entry, you can use the quick connect screen.

The hostname can be entered as either a hostname or IP address. Supported protocols are telnet and SSH. Changing the protocol will automatically change the port to the appropriate value, but this can be manually adjusted to suit your needs. If the protocol is set to SSH, the SCP button will also be enabled, allowing you to send or receive files from the specified host. See the SCP page for further information.

Supported terminal types are Linux and VT100. If you don't know which type to use, select 'Linux'. The differences between the two are minor.

Other settings will be inherited from the default profile, so if your default colour scheme is customised, a quick connect session will use the customised colour scheme.

The quick connect window will remember the last 200 hosts you connected to together with their protocol, port, terminal type and SOCKS settings. They can then be selected from the host combo box in future.


 Session Window

The session window has several useful features:

Text may be selected in the session window and copied. Double clicking on a word will select it, and triple clicking will select an entire line. This text can then be copied by hitting ALT-C on the keyboard or selecting copy from the context sensitive window (accessible by right clicking in the session window). Likewise, pasting can be done by hitting ALT-V or from the menu. ALT-B will copy and paste at the same time.

If the session window is scrolled back, PenguiNet will "lock" the scrollback at the current position, regardless of whether new data has arrived at the bottom. This is useful when attempting to copy text from a source which is continually outputting data (for example, an IRC window, a running logfile, etc.). This feature will only work until the limits of the scrollback are reached, at which point, the scrolling will continue, with the current position disappearing off the top. At any time you can scroll back to the bottom of the session window and scrolling will continue as normal.

From the context sensitive menu you can also enable the input bar, visible in this screenshot. This can also be enabled by hitting ALT-P on the keyboard. With the input bar enabled, any text you enter will not be sent to the remote terminal until you hit enter. The exception to this is control-chars. If you hit CTRL-C, CTRL-D, etc. it will be immediately sent.

You can also change the font from the menu. This will happen in realtime, rather than requiring the session to be restarted. Font changes made here are not saved with the profile setting. If you wish to change the font used permanently, do so from the Profile - Appearance page.


Connection Profiles

 Connection Profiles:

PenguiNet features a unique system of organising your hosts. The Connection Profiles are arranged in a hierarchical tree structure. Each and every configuration option may be specified at a given level. New entries under existing profiles automatically inherit the settings from the parent profile. This means you can configure all your default settings at the default level (Font, terminal type, protocol, etc.) and all profiles created hence will contain those options.

If a parent option is changed, all children will inherit this changed value unless the child value is different. For example, if the default font is set to Courier, and all children are also set to Courier, changing the default option will change the children underneath it. If for some reason you have configured one of the child profiles to use a specific font, changing the default option will not change this profile.

Clicking the SCP button will open an SCP connection to the host selected (provided the select protocol is SSH). If the selected profile has auto-login information, this will be used for the SCP login. See the SCP page for more information.


Login

 Login tab

The login tab contains basic login information. The hostname can be entered as either a hostname or IP address. Supported protocols are telnet and SSH. Changing the protocol will automatically change the port to the appropriate value, but this can be manually adjusted to suit your needs.

Supported terminal types are Linux and VT100. If you don't know which type to use, select 'Linux'. The differences between the two are minor. The username and password are not required. If unspecified, you will be prompted for this information when connecting to the host. If specified, these will be automatically entered on connection.


 SSH

The contents of the SSH tab will be enabled when the protocol of the connection is specified as SSH. If the protocol is telnet, the options on this tab are irrelevant and disabled

By default, the SSH version used to connect will be automatically chosen based on the preferences and availability on the remote host. However, if you have a need to force the use of SSH or SSH2, it can be done on this tab.

The Compression level that you choose applies to all encryption schemes and both SSH1 and SSH2. Whilst higher levels of compression have little impact on the client side, consider that a high compression rate may have a considerable impact on a multi-user server. Compression is desirable on modem lines and other slow connections, but will be detrimental to the speed of the connection on a fast network.

Authorization can be done either by username and password (specified on the login tab or during connection) or by using a public/private key pair. These can be generated from the menu option "Tools -> Generate New Public/Private Key Pair". See the page on public/private key pairs for further information.

SSH can also be used to do port forwarding, which can be configured from this tab. See the port forwarding page for more information.


 Appearance

The appearance tab allows you to control how your terminal looks. Although the font can be changed from here, it will not take effect until you restart the session. If you wish to change font mid-session, you can do this from the edit menu or the context sensitive menu (accessible by right clicking in the session window).

The colour scheme combo box allows you to specify a pre-configured colour scheme. This can be configured from the Tools -> Colour Schemes menu.

The Window title can be configured to show a variety of extra information, as defined in the following key. This key will appear when you click in the window title input box:

For example, the string: "%u@%h:%p (%t) - %d Connected for %o" would cause the window title to appear like this:

"joe_user@myremotehost.com (SSH2) - 80x25 Connected for 02:37:05"

You can also configure whether or not the cursor should blink in the remote terminal on this tab. The cursor will only ever blink when the session window is active. The input bar adds a bar below the session window which allows you to type text undisturbed by scrolling data in the session window. This is useful when using remote programs which don't have an input interface. The input bar can also be turned off from within the session window by using the keyboard shortcut ALT-P, the context sensitive menu, or from the View menu.

Initial terminal size can be used to pre-configure the size of the remote terminal window.


 Sound

Sounds are sometimes triggered by applications in a terminal window. For example, "bash" will trigger a sound when you hit delete on an empty line, or hit tab for filename completion and more than one file matches. By default, PenguiNet will use the default Windows beep for this sound. On this tab you can either disable this sound entirely or specify your own .wav file to use instead.


 Options

Using the first option on this page, you can instruct PenguiNet to automatically connect to the selected profile whenever PenguiNet is started. You can also disallow connection to a particular profile. This is useful when the profile is not configured to be connected to, but exists merely as a part of the tree in the profile view. For example, in the above screenshot, you may configure the profile entitled 'My LAN server' to not allow connection. These options are not automatically inherited from the parent, since these items tend to be profile specific.

If a profile entry has child entries, you can also enable connecting to the first child or all children when double clicking on that entry. This is useful when you have a series of hosts that you need to connect to at once.

If you have a SOCKS server configured it will be used for all connections by default. If you need to disable this functionality for a profile (if it were inside your network, for example), you can do this here.

Disable Nagle algorithm enables you to determine whether or not John Nagle's congestion control algorithm (as defined in RFC 896) is used. This algorithm coalesces multiple TCP packets into a single packet. On a local, fast network, there is little point in enabling this algorithm, but on slow remote connections it may help performance considerably. Please note that the algorithm will always be disabled for connections using SSH2 as it interacts badly with SSH2's flow control, resulting in significant slow down.

You can also disable both TCP and SSH/Telnet keepalives. You may wish to do this to stop a dial-up connection from being kept open unnecessarily. Additionally SSH/Telnet keepalives are potentially incompatible with very poorly written Telnet servers.

Clicking the keyboard options will open the following window with additional configuration options:

"Translate Backspace to Delete" and vice-versa enable you to swap these keys for hosts where they are interpreted incorrectly.

"Use keypad for PF1 -> PF4" enables the use of the keypad keys Num lock, /, * and - as PF1 -> PF4 for vt100 compatibility. It is highly unlikely that you will need to use this feature.


 SSH Features

PenguiNet supports both SSH1 and SSH2. The level of security of each of these protocols is constrained by the cipher in use. PenguiNet supports a wide range of ciphers, details of which can be found on the ciphers page.

PenguiNet also supports SSH port forwarding, which can be used to create a VPN (Virtual Private Network). This works with both SSH1 and SSH2. See the SSH port forwarding page for further information.

SCP allows you to transfer files between hosts using SSH to keep them secure. You can open SCP connections either from the quick connect window or by selecting an SSH enabled profile and clicking the SCP button on the Connection Profiles window. See the SCP page for details.


 Secure CoPy

SCP is a feature of SSH that allows you to transfer files securely between hosts. With a shell SSH client, you're required to know the remote path of the file you wish to download (or the path where you would like to upload). PenguiNet however, features a unique remote directory browser, facilitating extremely simple SCP transfers. Copying files is simply a matter of drag and drop.

When you click the SCP button from the connection profiles window, (provided the selected host has SSH selected as the protocol), or click the SCP button on the quick connect window, the SCP file browser window will open up, with the left pane pointing to your local hard drive, and the right pane pointing to your home directory on the remote host.

This window acts in much the same way as a normal Windows Explorer window. You can choose to display large icons, small icons, details or list. It's also possible to rename or delete files and create new directories (either locally or on the remote host).

From this screen you can either highlight the files you would like to copy from either the local or remote host and click the appropriate "Transfer" button, or simply drag and drop files between the two windows. A new feature in PenguiNet 2.0 is the ability to transfer directories. Simply drag and drop a directory and it will be copied recursively.

Once you begin a file transfer, the progress window opens. There is only ever one occurrence of this window. All transfers, whether an upload or download will appear here on the appropriate tab. This window may be opened or closed through the View menu. If you close the window, ongoing transfers will still continue and be visible when the window is re-opened.

On the options tab you can change the number of simultaneous file transfers that can take place at any time. Since each of these requires a new instance of sshd on the remote host, it's best to keep this number low, to prevent overloading the remote host. If you set this value to 0, the transfer will be paused until you increase the value again.

The "Tidy up" button will remove transfers from the list which are completed or have been cancelled by clicking on the "cancel" button. You can also click the "Open" button to launch files. You cannot launch files while they are in the process of being downloaded until they're complete.

You can also change the order in which files will be transferred by selecting them in the list and clicking the up/down buttons.

For more information about SCP, see the SCP man page.


 SSH Port Forwarding

SSH port forwarding is an option intended for advanced users. It can be used to create secure tunnels between your desktop machine and a remote server. The tunnel you create is encrypted only between your local machine and the remote machine. Anything outside of this is unencrypted.

This can be useful when you wish to encrypt an otherwise unencrypted connection (for example, POP3 for mail collection).

In the following diagram, the host running PenguiNet is listening on port 5000, and forwarding to port 110 on the remote host. This would allow users on the source host to collect mail by pointing their mail client at the PenguiNet host on port 5000. At first, this doesn't appear to gain anything in terms of security, but if the source host is the same machine as the PenguiNet host, and the destination host is the same machine running the sshd, at no point is unencrypted traffic sent over a network. This is especially useful with protocols such as pop3, where passwords are sent plaintext.

In order to set up this scenario in PenguiNet, you would configure the "Ports forwarded from this computer" section. The "from" port would be set to 5000, the "to" port set to 110, and the host set to either the name of the destination host, or "localhost" if the pop3 server was on the same machine as the sshd. The hostname configured in a local forward is relative to the remote connection, so a local forward to "127.0.0.1" forwards to the host running sshd. The configuration would look like this:

Remote forwarding works in the opposite manner. The port specified as the "from" port is forwarded to the "to" port on the hostname specified. In this case, the hostname is relative to the machine running PenguiNet.

For example, if the machine running PenguiNet is behind a firewall, a remote forward may be set up such that when a connection is made to the sshd machine on the port specified, it's forwarded to the machine "192.168.1.4" (a machine behind the firewall, on the same network as the computer running PenguiNet). This then allows external connections to pass through the firewall, but encrypted.

It's not currently possible to open an SSH forwarded connection without opening a shell connection at the same time. This functionality is planned for a future version. If you attempt to close an SSH forwarded connection while it is still being used, the SSH connection will wait until the forwarded connection is closed before closing.


 Tools menu

Several configuration options are set through the Tools menu:

Each of these options is discussed in the following chapter.


Profiles file encryption

 Profiles File encryption:

In order to preserve the security of your saved passwords in the profile window, PenguiNet encrypts the profiles file. The encryption is done using a password. If you do not specify a password, a default one will be used.

This password is processed using MD5 to produce a 128-bit key, which PenguiNet then uses to encrypt the profiles file using Blowfish in ECB (Electronic Code Book) mode.

What does this mean?

This means that anyone else with a copy of PenguiNet and a copy of your profiles file can log into your hosts, assuming you're using Telnet or SSH (with Password authentication), and you've entered your password in the Login section of the connection profile.

What can you do about this?

  1. Don't use the default password. Your PenguiNet profiles file is secure if you use a custom password. The only way someone could gain access to it is either to guess your password (so, use a good one, make it hard to guess), or to attempt a known-plaintext attack against the file (it is susceptible to this, but cryptographic experts estimate it would take many years to carry out this kind of attack against Blowfish, the cipher being used). You can change your password in the Tools menu.
  2. Don't store your passwords in the PenguiNet profiles file. If the passwords aren't there, then they can't be accessed.
  3. Use SSH with RSA authentication. The PenguiNet RSA identity files are not susceptible to a known-plaintext attack, and passphrases for them are not optional. Using this method also makes your SSH connection slightly more secure. For further information about RSA authentication, see the Public/Private key pair section.

If you forget your password it cannot be retrieved.


Public/Private key pairs

 Public/Private key Authentication

With Public/Private key Authentication, passwords are no longer exchanged between the client and the remote host. You will still specify a username, but the authentication will be done using keyfiles.

When you connect to a remote host, it will issue a random challenge, encrypted using the public key contained in your directory. It is then up to you to prove you have the private key by using it to decrypt the challenge. PenguiNet can be used to generate the public/private key pair. They can also be generated by the ssh-keygen command line tool. See the ssh(1) man page for more information.

How to generate public/private keys

  1. Determine whether you'll be using SSH1 or SSH2 to connect to your remote host, as you must use the correct type of key. If you're using an SSH1 connection, choose "SSH1 RSA Key" from the menu Tools -> Generate New Public/Private key pair. If you're using SSH2, pick either "OpenSSH compatible SSH2 RSA key" or "OpenSSH compatible SSH2 DSA key". The resultant key pair is generated in IETF standard format which can be converted for use with OpenSSH (see below for more information). Most likely, other SSH daemons include tools to do this as well. Consult the documentation for your sshd if uncertain.

  2. Enter a pass phrase (and in the case of SSH1, a comment) and pick the bit length of the resulting key pair. Once you've done this, the public and private keys will be generated.

  3. Specify a filename for the public/private keypair. The private key will have the exact name of what you enter, and the public key will have the same name but with a .pub extension

  4. Get the public key onto the remote host. Once it's there, it needs to be put in the right place. In the case of an SSH1 key, this is simply a case of placing the contents of the file into the file ~/.ssh/authorized_keys which can be done with this command:

    cat pubkey.pub >> ~/.ssh/authorized_keys

    For SSH2 keys, they must first be converted into the correct format. If you're using OpenSSH, this can be done as follows:

    ssh-keygen -i -f yourkey.pub >> ~/.ssh/authorized_keys

    The resulting converted key will be placed into the correct location.

  5. Configure your profile to use the private key. This can be done on the SSH tab by changing the "Authorization via" setting to "Public/Private key pair". This then enables you to specify an SSH1 key and/or SSH2 key. The private section is the file generated without an extension with the name specified previously. Please note, the existance of an SSH1 or SSH2 key does not guarantee that a connection will be made with SSH1 or SSH2. The order in which SSH1 or 2 is chosen is controlled by the remote SSHD unless you force the SSH version on the SSH tab. Even then, if the server does not allow the version you've selected, authentication with public/private keys will fail and default back to password authentication.

  6. Upon connection, you will be prompted for the passphrase. Once you've entered this it will be cached in PenguiNet until you restart, however it will never be stored in the profiles file.

If you do not use OpenSSH, consult the documentation for your sshd to determine how to convert IETF format public keys to the format required by the daemon.

For more information see the ssh(1) man page.


 SSH Algorithm preferences

SSH connections can use a multitude of different ciphers to encrypt traffic depending on what is supported on the remote daemon:

This section, accessible through the Tools menu, allows you to specify your preferences for which ciphers should be used. Please note, the default selections should provide a good balance of security and performance, and we recommend that they remain unchanged unless there are good reasons to change them. If you should choose to change any of the settings here, please read the descriptions below to help understand what the implications are of making such changes.

SSH1 Ciphers

DES - The Data Encryption Standard, developed by IBM and modified by the NSA, was standardised by NIST in 1977. It is a block cipher with an effective key length of 56 bits. It is not recommended that you choose DES unless you have particular grounds to do so - its limited key length means it's no longer considered to be sufficiently secure. In nearly 25 years of analysis, however, few significant weaknesses have been found in DES.

TripleDES - TripleDES is a method of using the DES cipher three times on each piece of data to be encrypted. With an effective key length of 168 bits and the extensive analysis of DES on its side, TripleDES is a conservative and secure choice. This conservatism comes at a price, though - DES is not fast on modern processors and TripleDES is therefore comparatively very slow.

Blowfish - Blowfish is a block cipher invented by Bruce Schneier in 1993. The variant used by SSH1 uses a 128-bit key. Since no significant vulnerabilities have been found in the cipher in the decade since its development, Blowfish can be regarded as providing sufficient security. For less conservative users who want to avoid the speed penalties of TripleDES, Blowfish is probably the best choice.

Arcfour (pronounced Ar-See-Four) is a public stream cipher posted to Usenet in 1995. It is widely believed that this algorithm is equivalent to the RC4 cipher from RSA Data Security (RC4 is a trademark of RSA Data Security). This algorithm is extremely fast. Unfortunately, a number of vulnerabilities were discovered with its implementation within SSH1 (details here). As such, it has been disabled by default in distributions from SSH, Inc since 1997 and is disabled by default in PenguiNet. Only enable this cipher if you are fully aware of the consequences.

SSH2 ciphers

TripleDES - See above.

Blowfish - See above.

AES/Rijndael - After reaffirming the DES standard in 1993, NIST decided to embark upon the AES (Advanced Encryption Standard) program to replace the aging cipher. 15 candidate algorithms from around the world competed in the first round of the competition in 1997. From these, 5 finalist algorithms (MARS, RC6, Serpent, Twofish and Rijndael) were selected - these were then subjected to widespread analysis. The 'Rijndael' algorithm won. It can be used with 128-bit, 192-bit and 256-bit keys. It is a very fast block cipher. Despite the intense scrutiny accorded to it as a result of its selection, has not shown any significant weaknesses. The algorithm is still comparatively young, however. The algorithm is named for its creators, Vincent Rijmen and Joan Daemen.

CAST - CAST was designed by Canadians Carlisle Adams and Stafford Tavares, who claim the algorithm's name is unrelated to their initials. The variant used by SSH uses a 128-bit key. Cryptanalysis of CAST has not found any method of breaking it more efficient than brute force.

Twofish - One of the finalists in the AES competition, Twofish is a block cipher developed by Bruce Schneier (inventor of Blowfish), John Kelsey, Doug Whiting, David Wagner, Chris Hall and Niels Ferguson. The cipher can work with 128, 192 and 256-bit keys. Twofish is just as fast as Rijndael and also shows no significant security problems.

Serpent - Designed by its authors to value security above speed, Serpent was "runner-up" in the final vote of the AES competition. This block cipher can be used with 128, 192 or 256 bit keys. It should be noted that since no SSH server currently implements Serpent support, PenguiNet's implementation is as-yet untested. It should also be noted that PenguiNet's implementation of the cipher itself is comparitively very slow.

Arcfour - See above. The implementation of this algorithm in SSH2 does not suffer from the same security vulnerabilities as that in SSH1.

SSH2 public key algorithms

RSA - Invented by cryptographers Ronald Rivest, Adi Shamir and Leonard Adleman in 1977, RSA has been the de-facto standard in public key systems since it was originally published against the will of the NSA. RSA Data Security, Inc. held a patent on the RSA algorithm in the US until its expiration on September 20, 2000. Although the security of RSA has not yet been mathematically proven, it is widely held to be secure. RSA can be used with any length key, but for PenguiNet's purposes, key lengths are restricted to a minimum of 512 bits and a maximum of 2048 bits. 1024 bit keys make a sensible compromise between security and speed. As number-factoring technologies improve, 512-bit keys will become more vulnerable, though they currently remain secure for all practical purposes.

DSS - The Digital Signature Standard, developed by the NSA. DSA is slower than RSA and can only be used with 512 or 1024 bit keys (originally, the NSA wanted only to allow 512-bit keys). NIST made DSS the standard digital signature algorithm for the US government in 1994. Although no critical security flaws have been found in DSA, the algorithm does contain several properties which are less than desirable. For this reason, we recommend you use RSA.

SSH2 MACs

SHA1 - Designed by NIST and the NSA for use with DSS, SHA1 produces a 160-bit hash. There are no known attacks against SHA1 and its long hash size makes brute-force attacks even less practical than with 128-bit hashes. SHA1's construction means it is probably not susceptible to the same attacks as MD5 and other MD4-based ciphers. SHA1 is a revision of the original SHA. This revision was made due to a flaw in the original version - the details of this flaw were never published, however.

MD5 - A modified version of the earlier MD4 algorithm (on which SHA1 is also loosely based), MD5 was developed by Ronald Rivest (the 'R' of RSA). The algorithm produces a 128-bit hash. Although in widespread use, vulnerabilities have been found in MD5 which have caused wariness regarding its future use (though there are still no practical attacks against it). Fortunately, its use as part of a HMAC in SSH lessens the degree of the problem. While there is no security problem in using MD5, SHA should probably be used in preference (if only because of its longer hash length).

RIPEMD-160 - Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel, RIPEMD-160 is an evolution of the original RIPEMD (created as part of the European Union's RIPE project and itself based on MD4) which outputs a 160-bit hash (as opposed to RIPEMD's 128 bits). RIPEMD-160 is slower than SHA1.

SHA1-96 - This is exactly the same as SHA1, but only the first 96 bits of the resulting hash value are used. This makes the probability of an attack higher, but saves transmission overhead.

MD5-96 - This is exactly the same as MD5, but only the first 96 bits of the resulting hash value are used. This makes the probability of an attack higher, but saves transmission overhead.


 Linux console fonts

Since we at Silicon Circus became quite attached to various Linux console fonts, (particularly the t.fnt which is distributed with PenguiNet), we have included within PenguiNet the ability to convert a Linux console font to a Windows font. In order to use this feature, select the menu option Tools -> Convert Linux Font. You will then be presented with a dialog to select the source file. This will then be converted and saved in the same directory.

The fonts which PenguiNet can convert to Linux fonts are the format used by Slackware. If you can find a friend with a copy of Slackware installed, you'll find the fonts in /usr/lib/kbd/consolefonts. They're usually gzipped, so you'll need to gunzip them first.

If you've no copies of Slackware handy, you can still get the Slackware fonts. Find a Slackware mirror from the Slackware mirror list, FTP to it, and take a look in the slackware-7.1/source/a/kbd/ directory. You'll find the fonts in 'extraf.tgz' and 'kbd-0.99.tar.bz2'. There's a bunch of other things in kbd-0.99.tar.bz2, so you might have to do a bit of looking through it to find the fonts. extraf.tgz is just a bunch of extra fonts on its own. All the fonts have a .fnt extension.


 Colour schemes

Custom colour schemes can be created here and then selected on the appearance tab of the connection profiles.

There are 16 colour codes which can be modified. The defaults conform to the ANSI standard. In most situations, the values 0 and 7 are used for background and foreground respectively. The "Background" and "Text" buttons on this page are a shortcut to the values 0 and 7.

Any changes you make here will be shown in the preview window so you can see how they look before saving. You can either change the default colour scheme which will then effect all profiles, or create your own custom scheme and assign it to specific profiles.

If you delete a colour scheme, any profiles using that scheme will fall back to the default scheme. You cannot delete or rename the default scheme.


 Options

Settings

Add CR/LF to copied text - When copying data from a session window, automatically add in carriage return/line feed data at the end of each line. This means that lines that were wrapped in the original copy will be wrapped in the paste as well. This behavior can be changed at the moment of copying by holding down the shift key. This will reverse the setting specified here.

Confirm quit when connections open - If you attempt to close PenguiNet while you still have connections open, this option will cause a confirmation dialog to appear before the close will happen. This is useful if you accidentally hit the close button.

Jump to bottom on key press - If you have scrolled back a session window, typing a character in that session window will cause the scroll to jump back to the current line.

Check for PenguiNet updates - With this option enabled, each time you start PenguiNet, an auto-update check is fired off. This check makes an http (web) request to http://www.siliconcircus.com/penguinet/autoupdate.php. This page indicates to PenguiNet whether or not a new version is available, and if so, you are presented with the option to download the update.
There is no security risk posed by leaving this enabled (no information is sent with the auto-update request), but if you prefer to disable the auto-update, un-check this option.

... lines of scrollback - This setting effects all session windows. A large scrollback will consume considerable amounts of memory, so a reasonable value for this would be 200 lines.

Emulate SDI - When this option is enabled, PenguiNet will act like an SDI application. This means that new session windows will open outside of the main PenguiNet window and can be individually controlled. The Window menu option will no longer be available, since those options do not apply.
When enabling or disabling SDI emulation, the change will not take full effect until PenguiNet is restarted.

Minimise to systray - This option will cause PenguiNet to minimise to the system tray instead of to the Windows taskbar.

Show 'Connection closed' messages - If you un-check this option, when a connection is closed normally, the session window will automatically close and no message will appear. If the connection is closed abnormally (due to a timeout, for example), you will still receive a connection closed message.

Open profiles window when started - This will cause the profiles window to automatically open when launching PenguiNet.

Show splash screen - This option is only available to registered users. When un-checked, the splash screen which appears upon starting PenguiNet will no longer appear.

Use middle mouse button as paste - Un-checking this option will disable the functionality which enables a paste to be done by pushing your middle mouse button, if available. On a wheel mouse, this is typically achieved by pushing the wheel down, rather than rolling the wheel.

Proxy

PenguiNet supports SOCKS 4 and SOCKS 5 proxy servers. Configuration details entered here will effect all profiles unless explicitly disabled on the Connection profiles - options tab. If you need to use a SOCKS server, contact your system administrator for the information if necessary.