How to let the office know the use of open SSH server

Question

I work in a software company where average number of years of experience is 12+.

There are quite a few servers that are used by developers and QAs. In some QA machines, multiple applications are deployed that are used by various teams.

Now, the point which I think belongs to stone age is that, every single person in the office uses mstsc to access those machines, esp for logs, deployment, restarting the server etc.

They are all windows based machines and open SSH server can easily be installed and at the client end, install open ssh client and access servers to deploy etc and use tools like winscp to access logs etc.

Now, that was simple. But, everyone is so obsessed with mstsc that they do not want to believe that there is an easy way to access those servers. I faced reluctance from 2-4 members.

Sometimes, I feel I am working with stone age persons who are reluctant to change. How can I bring a change in accessing the servers?

Answer 1

Do not proceed. An improperly setup SSH service is a major security risk

You are talking about implementing a remote administration interface onto these systems. Chances are, your system administrators have set up device-based authentication on their RDP service (what you are referring to as 'mstsc'), meaning that the client and server devices authenticate that they are who they say they are, as well as user-based authentication.

If you use a default OpenSSH install, you are creating a security risk by bypassing device authentication that is probably present on the RDP server.

If you do not have access to firewalling and/or do not limit what interfaces your OpenSSH servers listen on, you are creating a security risk by potentially exposing the service beyond the intended userbase.

If you do not securely set up logging, you're introducing a security risk by allowing users to remove accountability by removing log files.

I could go on all day. The point is, there is a lot of reluctance for very good reason. If you have setup any OpenSSH servers without authorisation, remove them now!

RDP works, is reliable, can be configured by Group Policy, and its configurations are well known in the Windows Sysadmin world. Windows SSH, which is the official Windows implementation from Microsoft and is NOT OpenSSH, is new to the Windows ecosystem and its configurations are not well known in that crowd. That's not even getting into OpenSSH, which cannot even be configured via Group Policy.

EDIT: Also, to clarify, winscp is a remote file copying program, not a log viewing one. It copies files to and from systems with SSH servers. There are many, many security related reasons why you probably don't want remote system logs on employee workstations.

Answer 2

Beware of the logical fallacy of chronological snobbery, in which something is assumed to be better merely because it's newer.

"This is Stone Age" is not a valid reason to upgrade, especially if there are existing workflows that are already working.

Upgrades can involve a lot of work and risk, and unless there's clear evidence that what you're suggesting is significantly better people probably won't agree to make the change.

You should have a clear idea of why you think that them using this technology is a problem, or why what you're suggesting is superior. For example, is it more secure? Will it help people work faster? Are there certain features that that would enable that would be helpful for the product?

Let me emphasize again that "we're using an old technology" is not, in and of itself, a valid reason to upgrade. Otherwise, this is what's known as a "solution looking for a problem." While that's quite tempting sometimes, make sure that you're focusing on valid technical and business reasons to make changes.

Edit: It might be easier to convince people to at least give people a choice of which one to use, but I don't think that you'll have much luck convincing people to change without a clear benefit.