.
Since the Internet was originally a place where honesty reigned, or so we're told, most Internet standards are based on trust. This means they send passwords in "clear text" without any attempt to hide them, so if you can tap into a connection, you can get as many passwords as you like. That's especially true if people use wireless technologies. The solutions are --
1) Avoid using public terminals and wireless access, especially in public places, to do your Web site maintenance,
2) Use a different password for e-mail than for file transfer and login, and
3) Use technologies that encrypt your passwords - that is, scramble them in a way that's hard to interpret.
Most of the time, you will be using passwords with your site for three purposes: e-mail, terminal/shell access (not everyone uses this at all), and file transfer. This page describes ways to scramble your passwords in all three cases.
You need are an ISP or server with SSH installed, and shell access. I strongly recommend that, once you get this working, you shut off Telnet access, and change your password. Always use passwords that can't be guessed by a dictionary (that is, not real words), preferably with numbers and odD caSing, and never, never, never make the password the same as your username.
I can recommend three programs for SSH, depending on your computer platform. All three allow a great deal of customization in terms of terminal emulations, fonts, colors, and shortcuts (saving account information).
Windows: I've had my best luck using OpenSSH, a free program that works intuitively under Windows and includes an SFTP client for secure file transfer.
Mac OS X: iTerm - it's easy to use and free, and includes a tabbed interface so you can quickly switch between a local connection and one or more SSH (shell/terminal) connections. You can have one window with one directory open and another window with another directory.
Mac OS 9: MacSSH - it's easy to use and free. It also has special features, e.g. allowing you to set up a tunnel via a graphical interface so if you don't have sftp, which you probably do, or if you have a particular ftp program you need (Retrospect?), you can easily route it through the ssh "tunnel" from MacSSH (see file transfer instructions.) One nice thing about MacSSH is that it can enter your password automatically, saving time albeit at a bit of a security risk (if your computer is stolen or used by someone else).
There are two ways to transfer e-mail securely: by specifying SSL or TSL in the appropriate place in your e-mail program's settings/options, or by using a tunnel (see below). The easiest way is SSL or TSL but your ISP has to be set up to handle it. If they don't already have it, or if you can't figure out how to activate it on your dedicated server and want to use e-mail while you figure it out, go to the tunnelling section.
(Another reason to use a tunnel is if you have a specialty e-mail program, like MailSiphon, that doesn't support secure connections, and you want to use it from time to time.)
There are a number of easy file transfer programs that use SSH or other secured FTP methods to move files between your computer and your server without revealing your password to casual eavesdroppers. I recommend OpenSSH again on the PC side; on the Mac side, MacSFTP is just about the only Mac OS 9-compatible program, while OS X users have a huge variety of software available. While there are free solutions, I paid for Transmit because it's elegant and does all sorts of other clever things that helps me maintain my server.
One quick aside — you can run into problems if your files or directories have unconventional names - spaces can cause issues. Use hyphens or underlines instead of spaces (search engines apparently prefer hyphens).
Why would you want to tunnel? Sometimes you need a secure connection, which will keep your passwords away from prying eyes, but you have programs that send clear-text passwords - ftp clients, MailSiphon, etc. A tunnel sets up a secured connection, using SSH, and your insecure traffic travels through it. The programs don't know anything is different, but an eavesdropper will just see nonsense. This is especially useful for older versions of Adobe GoLive and Dreamweaver, which can update web sites via FTP but not SFTP.
I don't have Windows instructions yet but I suspect they're similar to the Mac instructions.
First, I would like to thank Jean-Pierre Stierlin, the writer of MacSSH and MacSFTP, for his extensive help in getting me set up and running - and the people at Esosoft for their help as well.
Under Mac OS 7.5.3 through 9.2.2, the best way to assure secure connections was often via an SSH tunnel, especially when using GoLive and Dreamweaver, which never did get SFTP under pre-OS X systems. So I set up a tunnel using MacSSH. This is not unlike the way you connect to the Internet by dialing your local ISP (or connecting to your cable or DSL); the connection goes through MacSSH to get to its destination.
MacSSH comes with instructions, but I had some issues and questions which I will detail here. I won't duplicate all of MacSSH's instructions, just go over the issues I had.
First, to get FTP to work, you need to use passive mode. In GoLive, this is under Site - Settings - FTP - Advanced. In Fetch, it's under one of the preferences tabs. Passive mode is no problem most of the time, and you probably won't notice the difference.
Second, I set up just two tunnels: one for port 21 (FTP) and one for port 110 (POP3, or incoming mail). If I needed to secure SMTP (outgoing mail), I'd also set up one for port 25. Since MacSSH automatically creates a Telnet terminal, I didn't bother routing that.
To set up the first tunnel (POP3), I modified the default MacSSH connection settings (Favorites / Edit Favorites / Default) (and later set up the preferences to automatically start the default connection when starting up MacSSH, that removes an annoying step).
When you do this, I strongly suggest you also edit the default MacSSH terminal - make the font larger and set it up as a VT100 or VT220 so you can use pico and pine. Also, remember to log out when you're done with a session!
This whole process is much easier to use than it sounds, since all I have to do is open MacSSH and I'm totally secure. Until I open MacSSH, though, none of my file transfers (or non-Eudora e-mail) will work!
Believe it or not, most of this is from trial and error.
If you are using Classic apps - for example, GoLive 5 or a non-Carbon version of Fetch or MailSiphon - first open the Classic app, then open MacSSH while in Classic, and run it according to the instructions for "SSH under MacOS 7.5 to Mac OS9."
This method was sent in by Marc Poirier. The idea here is to keep using your standard ftp software, but to have a secure connection. Frankly, we find Transmit much easier, but if you're wedded to an older version of GoLive or Dreamweaver or have ssh but not sftp access... go for it.
1) Open a Terminal window
2) Type in the following formula:
sudo ssh -l [your remote username] -L 21[the remote site]:21 -L 110:[remote site]:110 [remote site]
For example, for my site, allpar.com, with username macdude, it would be:
sudo ssh -l macdude -L 21:allpar.com:21 -L 110:allpar.com:110 allpar.com
This creates a tunnel in OS X but not in Classic programs.
Then, when you are making bookmarks or connections in Fetch, GoLive, MailSiphon, etc. - in other words, in any program - use 127.0.0.1 as the remote server (as detailed in the OS 9 solution at the top of the page). Otherwise, you won't be using the tunnel!
Note that you can save the command for easy reference either by copying and pasting it somewhere else, or by this method sent in by Marc:
If you are using Terminal or another tcsh shell, then create a file called .tcshrc in your home directory (if you don't already have one) and add this line:
alias tunnel 'sudo ssh -l macdude -L 21:allpar.com:21 -L 110:allpar.com:110 allpar.com'
That will create an alias called "tunnel" and then all you have to do to run that command is enter the word "tunnel" in Terminal. To create that .tcshrc file, probably the easiest way is to use pico (the simplest UNIX text editor), for example:
pico ~/.tcshrc