Here’s the scenario: you’ve just started a meeting with your IT security chief and, as you’re describing how the big client wants you to set up an FTP server so they can upload a bunch of confidential files for your project, you notice that the chief’s face is turning an interesting shade of red. In the calm, measured voice that lets you know you’ve just stepped into a minefield, she suggests that you might want to find a file transfer mechanism that is ever-so-slightly more secure than FTP. Or else.

Since you are, of course, a strong advocate of open source solutions, you do some research and discover OpenSSH and the SSH File Transfer Protocol (also know as SFTP). SFTP looks like it’s just the ticket and puts a smile on the security chief’s face. The only problem is that your server room runs on Windows and OpenSSH doesn’t. After a little more research, you find that OpenSSH does run on Windows — it just needs a little help from the Cygwin project. Now if you could just find some instructions on how to get started. This is where we come in.

Before You Start

This is a bare bones guide to getting an OpenSSH Secure Shell (SSH) and SFTP (Secure File Transfer Protocol) server running under Windows. You will need a copy of the Cygwin installer, Internet access, and an Administrator account on your Windows server. You can download the Cygwin installer (setup.exe) from cygwin.com. At the time this tutorial was published, the Cygwin installer was at version 1.5.25-15.

Please note that the basic instructions covered in this tutorial should work on most versions of Windows and have been thoroughly tested on Windows XP and Vista. We have included version-specific notes where the instructions diverged.

Meat & Potatoes

Installation

Because OpenSSH is available as an optional component of Cygwin, the easiest way to get OpenSSH running under Windows is to employ a custom Cygwin install.

1. Login to Windows using an administrator account.
2. Copy the Cygwin installer somewhere convenient (like c:\, for example).
3. Run setup.exe.

   
   Cygwin installation type

4. Choose “Install from Internet”.
5. Select a directory for the installed Cygwin files (the “Root Directory”). The default c:\cygwin will work fine. Make sure “Install For” is set to “All Users” and “Default Text File Type” is set to “Unix/binary”.

   
   Cygwin install location

6. Select a directory for the downloaded installation files (the “Local Package Directory”). It’s better if this is not the same as the Root Directory. Something like c:\cygwin_packages works well.

   
   Cygwin packages location

7. For the Internet connection, “Direct Connection” will probably work. If not, check with your network administrator to see what’s most appropriate.

   
   Cygwin connection type

8. The download sites are mirrors of the central Cygwin package repository and should have essentially identical content. Choosing a site in your region will likely result in speedier downloads.

   
   Cygwin download site

9. Once the installer has downloaded and displayed the list of packages available on the repository, click on the “View” button until the text to the right of the button says “Full”. In the list of packages, scroll down until you see a package called “openssh: The OpenSSH server and client programs” in the Package column. Under the New column, click on the word “Skip”. This should display a version number for the installable OpenSSH package. Note that this may change the status on other packages, from “Skip” to a version. Don’t change those entries! They’re packages upon which OpenSSH depends.

   
   Cygwin OpenSSH package selection

10. The next screen will begin the installation process. Installation will take some time and may be a good opportunity to take a coffee break (or two).
11. Once the installation is complete, you can choose whether or not to add Cygwin shortcuts to the Start menu or Desktop.
12. Now launch the Cygwin shell (this is similar to a DOS/command window) by clicking on a shortcut (if you created one during the installation), or by running c:\cygwin\Cygwin.bat.

Vista vs. XP Note: on Windows XP you can simply run the Cygwin.bat. On Vista, you’ll need to run Cygwin.bat as an administrator.

13. On XP: At the prompt, run the following commands:
    export CYGWIN='ntsec tty'
chmod +rw /etc/group
chmod +rw /etc/passwd
chmod 0755 /var
ssh-host-config -y
net start sshd

    On Vista: At the prompt, run the following commands:
    export CYGWIN='ntsec tty'
chmod +rw /etc/group
chmod +rw /etc/passwd
chmod 0755 /var
ssh-host-config
    Answer yes to each question except “Do you want to use a different name?” and “Create new privileged user account ‘cyg_server’?” The answer to both of these is no.
    net start sshd

    This will configure, install and start the SSH/SFTP server as a Windows service.

14. Synchronize Cygwin user information with your Windows users by running:
    mkpasswd -cl > /etc/password
mkgroup --local > /etc/group
15. You can test the server by connecting from another system using an SFTP client such as FileZilla or an SSH client such as PuTTY.

Note: The default configuration we’ve gone through uses port 22 for SSH connections. You will need to open this port in your firewall in order for the SSH server to work.

Configuring A User’s Home Directory

For most Windows users and administrators, a user’s home directory is c:\Documents and Settings\[user name]. However, under Cygwin and OpenSSH, when remote users log in they may be surprised to find their (Cygwin) home is under c:\cygwin\home\[user name]. Fortunately, changing the Cygwin/OpenSSH behavior to match Windows standard behavior more closely is pretty straightforward, provided you understand the differences in the path conventions for Windows and Cygwin.

Translating Paths From Cygwin to Windows and Back

Since Cygwin is a Linux/Unix emulation that runs on top of Windows, the Cygwin shell does some things quite differently from Windows or a DOS command shell. Most notably, the paths in Cygwin follow a different, Linux-like convention.

Under Linux (and Cygwin), the file system has a single top level called the root and written “/”. The path delimiters are slashes, so, for example, the path to a directory called user inside a directory called home would be “/home/user”.

Windows, of course, supports multiple top levels on the file system: c:\, d:\, e:\ etc. The path delimiters are back-slashes and a similar path on the c drive would be “c:\home\user”.

In order for Cygwin to let Linux applications understand path information, Cygwin paths follow the Linux convention. However, the root directory in Cygwin points to the Windows directory in which Cygwin was installed.

To shoehorn the Windows path information in under the Linux convention, Cygwin puts the drive letters under a “cygdrive” directory. So, the path to the file “c:\home\user\myfile.txt” (Windows-speak) in Cygwin is “/cygdrive/c/home/user/myfile.txt”. The Cygwin path for something on, say, the g:\ drive, would be “/cygdrive/g/…”

Some general path examples for Windows:

Note the escaped space in the Cygwin path for the fourth example.

Default Directory for Users

Here’s why we need all this path information: when using the mkpasswd command to create Cygwin user accounts from local Windows user accounts, the user’s (Cygwin) home directory will default to “/home/[username]” (Cygwin path).

When that user logs in remotely through SFTP, he or she will start in that home directory; so in order to change the starting point for an SFTP session, the home directory setting for the user will need to be updated.

To change this, open the file /etc/passwd in a text editor that understands how to read Unix line endings.

Warning: Notepad doesn’t read Unix files correctly. Wordpad does, but if you use Wordpad, be very careful to save the passwd file in a text format. Saving in any non-text format will break the file which will have unfortunate effects on Cygwin.

Each line in the file corresponds to the Cygwin settings for a particular user. The entries are separated by colons, “:”. There are seven entries for each user:

1. Username.
2. Password: actually a placeholder.
3. User ID (UID): a unique number assigned to each users.
4. Group ID (GID): the unique number assigned to the user’s primary group.
5. User ID Information: A comment field, normally used for human readable information about a user.
6. Home Directory: the path of the user’s home directory.
7. User’s Default Shell: the path to the shell executable. In Cygwin, this is almost always /bin/bash.

Change the 6th field to the path you’d like as the SFTP entry point for each user. Note that this must be a Cygwin-style path, for example: /cygdrive/c/Documents\ and\ Settings/[user name].

Once the service has been restarted, the new home directories will take effect.

Finishing Up

Now that the server is set for secure transfers, the users have the right home directories, and all is right with the world, it might be a good time to mention that your big client is going to need some way of connecting with the new SFTP server. Since FTP and SFTP are entirely different under the hood, the client will need a new client. Fortunately, the open source community can help once again. WinSCP is an excellent, streamlined Windows SFTP client which also supports FTP and SCP file transfers. If you need a cross-platform client, you might also consider FileZilla, an SFTP, FTP, and FTPS client that runs on Windows, Linux, Mac OS X, the BSDs, and other platforms.

With adoption of Firefox on the increase, enterprise IT shops face a challenge: how to provide Firefox to their users while keeping a handle on security. To address this, we suggest creating a customized Firefox installer preconfigured with the extensions and settings approved by your IT department. This tutorial takes you through that process.

Before You Start

Before customizing Firefox, avoid headaches by looking carefully at which extensions best suit your needs. You, or your IT team, should also thoroughly research the Firefox settings and create a list of those you wish to include.

Extensions

One of Firefox’s greatest strengths is its diverse collection of extensions. Extensions such as NoScript or CookieSafe can be used to secure Firefox, while AdBlock or one of its variants could help reduce unwanted traffic to ad servers. Before building a customized installer, you will need to decide which extensions best meet your needs and the needs of your users. With an eye toward security policies and customer requests, browse the Firefox Add-on Repository and download the (Firefox 3-compatible) add-ons that best meet your needs.

Settings

Firefox offers a large number of settings, many of which aren’t accessible through the standard preferences/options dialog window. To see the available options, enter “about:config” in Firefox’s location bar. This will display a list of all settings. While the list is intimidating, Mozilla publishes a reference to all of the settings. Review the  options and collect a list of settings for which you’d either like to set a custom default value or completely lock down to a specific value.

What You Will Need

Once you’ve decided what extensions and settings you’d like in your spiffy custom installer, there are a few components you’ll need.

For a custom Windows installer, grab

1. A current, standard Firefox 3 installer for Windows.
2. A current app.tag file from Mozilla’s site (copy the appropriate text from http://lxr.mozilla.org/mozilla/source/browser/installer/windows/app.tag into a text file called app.tag).
3. A 7zSD.sfx file from Mozilla’s site (download this from http://lxr.mozilla.org/mozilla/source/other-licenses/7zstub/firefox/7zSD.sfx?raw=1).
4. The 7zip command line utility (currently at http://downloads.sourceforge.net/sevenzip/7za457.zip).

For a custom Linux installer,you’ll need to

1. Grab a current standard Firefox 3 binary for Linux.
2. Have familiarity with tar and gzip.

You’ll also need copies of each extension you wish to include in the installer (the xpi files), and the list of settings and values.

Note for Mac users: I’m working on a version of this article for Firefox 3 on the Mac, but I’m still sorting out the details of repackaging a dmg file.

Meat & Potatoes

Creating Your Settings File

The settings file I’m going to describe is basically just a Javascript file with a set of calls to two Firefox-defined JS functions, defaultPref and lockPref. Unsurprisingly, the defaultPref function can be used to specify a default value for a setting and lockPref sets the value for the setting so that it cannot be changed by the user. Each has similar arguments:

function defaultPref(prefName, value)
function lockPref(prefName, value)

so, for example, you could set the default home page using

defaultPref("browser.startup.homepage","http://www.mycompany.com/portal");

or, you could require that the browser always check for updates

lockPref("app.update.enabled",true);

You can find additional information about these and other preference Javascript functions for Firefox in “MCD, Mission Control Desktop AKA AutoConfig” at the Mozilla Developer Center.

Use the list of settings you prepared to build a settings file. For the rest of the article, I’ll refer to this file as “firefox.cfg”, although you can use any name you prefer.

Note: Since the settings file is a Javascript file, there are many sophisticated and clever javascript tricks you can include, but I’m not going to cover any of them.

Making Your Extensions Manually Installable

The next step is to prepare your chosen extensions to be manually installed. For each extension,

1. Unzip the xpi file (using 7zip, WinZip, Zip-Info or your preferred tool). You’ll end up with a folder probably with the same name as the extension (for example, NoScript)
2. In the folder, find the file called install.rdf, open it in a text editor and find the <em:id> tag under the <Description> tag. This is the unique ID of the extension ({73a6fe31-595d-460b-a920-fcc0f8843232} for NoScript)
3. Change the name of the extension folder to the extension’s ID (e.g. Change the “NoScript” folder to “{73a6fe31-595d-460b-a920-fcc0f8843232}”)

On To the Installer

Now we’re ready to rebuild the installer.

Windows Installer

Let’s walk through the process for the Windows installer and then I’ll describe the somewhat simpler process on Linux.

1. The Firefox installer is basically a self-extracting 7zip archive. You can open the 3.0.3 installer into a directory called “firefox-win” using

   7za x -ofirefox-win "Firefox Setup 3.0.3.exe"

2. Copy each of the renamed extension folders into firefox-win\nonlocalized\extensions\ (assuming Windows path style). That’s all that needs to be done for a generic extension installations. If the extensions add new settings, the installer will use the default values for those settings. Those settings could also be added to the firefox.cfg file, if you needed to change them, but I won’t go into details here.
3. Create a file called firefox.cfg in firefox-win\nonlocalized\ where the firefox.exe file is located. Here’s an example firefox.cfg which provides some basic security settings (note that everything in the example config file is commented out so it can be tested without affecting any settings at all; uncomment the settings you’d like to try).
4. Open firefox-win\nonlocalized\greprefs\all.js in a text editor and add the following lines

pref('general.config.obscure_value', 0);
pref('general.config.filename', 'firefox.cfg');

This causes Firefox 3 to load the settings in the firefox.cfg file.

5. Build a new exe installer from the firefox-win folder: cd into firefox-win and execute the following commands
   1. 7za a -t7z ..\custom.7z
   2. cd ..
   3. copy /b 7zSD.sfx+app.tag+custom.7z FirefoxCustomInstall.exe

Linux Installer

When you download Firefox for Linux, instead of an installer, you’ll just have a tarball. This means you can untar it, walk through steps 2-4 in the Windows process and re-archive the directory.

Finishing Up

Distribute your newly created .exe to users and you’re set!