PuTTY 0.63 released, fixing four security holes(chiark.greenend.org.uk)

138 pointsby bwblabsvor 13 Jahren84 comments

chiark.greenend.org.uk

PuTTY 0.63 released, fixing four security holes

http://www.chiark.greenend.org.uk/~sgtatham/putty/

10 comments

jontrovor 13 Jahren

The security holes are not critical but of course you should upgrade anyways.

3 of the holes have the following notice: We are currently unaware of any way in which this can lead to remote code execution.

4th hole is that putty does not cleanup sensitive memory when it could.

gcb0vor 13 Jahren

3 better-safe-than-sorry-in-improbably-scenario ones and one that requires an attacker to have physical access to your machine (or just to your memory and a good freezer, if you remember that hack hack :)

Seems like the best time to upgrade is in a few weeks after the crypto community had some time to analyse the changes. Maybe upgrading in a rush is as bad nowadays than not upgrading, with all the ... terrorism?... going on.

randallsquaredvor 13 Jahren

Since starting to use Windows 8, I found that the grouping behavior of the taskbar combined with a dozen open PuTTY windows drove me insane. There's a multiple-tabbed PuTTY shell, but it was hard to get used to as well. I finally switched to the Chrome SSH client, which has been much better (though it doesn't have nearly the features of PuTTY, of course).

sequoiavor 13 Jahren

If you have a ton of shell connections open at once, consider trying a "base station" linux machine from which you jump out to other machines, + tmux. This way you ssh to machine1, run tmux, then you can create as many sessions as you want in whatever combination of windows/tabs you like. Bonus: you can disconnect from machine1, and when you reconnect everything is still in place. Worth a try for sure!

mirkulesvor 13 Jahren

My first thought was this sounds a lot like the "screen" command. Which is basically true, but with the added benefit of screen splitting. Also, tmux is distributed under the BSD license (instead of GPL).

http://www.wikivs.com/wiki/Screen_vs_tmux

regularfryvor 13 Jahren

That article implies that tmux is faster than screen. While it may be the case that it uses fewer resources (which I've not checked), it's exclusively been my experience that tmux is laggy where screen isn't.

Freakyvor 13 Jahren

That's not been my experience at all - I can't say I've ever seen tmux perform noticeably worse than screen, but under extreme load tmux always seems to cope better. e.g. dumping 250k lines takes screen over a minute, while tmux will be done in under 3 seconds and be more responsive while that's happening. It's nice to be able to ^C something spammy and not have time to go make a cup of tea before it responds.

I have experienced lagginess with tmux, but this has been more down to VTE and/or mosh performing particularly badly with large terminals. A fullscreen 266x188 tmux session on urxvt is massively smoother than with Terminator/gnome-terminal/Terminology/etc, and with remote sessions ssh is similarly massively smoother than mosh. Kind of disheartening given today's ridiculously powerful hardware.

regularfryvor 13 Jahren

Weird. I've had tmux lock up when too much text gets dumped through it.

oinksoftvor 13 Jahren

It's been a while since I was stuck on a Windows box, but I found the combination of Console2 (tabbed terminal emulator) with Cygwin[1] was quite nice. Then you can use `ssh', `scp', etc. like you would on a Unix machine. You might want to try this approach if you're willing to go as far as to do this from your browser (which gives me shivers). This was on Windows XP but I imagine it still works.

[1] http://sourceforge.net/projects/console/files/

emmelaichvor 13 Jahren

Console2 looks good.

I played with "Putty Session Manager" for a while before moving entirely to Mintty under Cygwin.

isxekvor 13 Jahren

There's a fork named ConsoleZ [1] which is more actively developed. It provides a number of features which goes well with newer versions of Windows.

[1] https://github.com/cbucher/console/wiki/Downloads

gnudvor 13 Jahren

You should have a look at ConEmu[1] as well

[1]: http://code.google.com/p/conemu-maximus5/

dmunozvor 13 Jahren

Regarding the grouping behaviour of Windows, I have long been using 7+ Taskbar Tweaker [0]. I believe it works with Windows 8 as well, but I have never used it on 8.

You can configure it in many ways. I have it always show small icons, but you can have it group icons by program and have them auto expand on mouse hover.

[0] http://rammichael.com/7-taskbar-tweaker

fsckinvor 13 Jahren

If you've got a dozen open PuTTY windows, you should really look at SecureCRT. Tabbed sessions, tiling, configurable keyboard/mouse shortcuts, password encryption/automatic session login and best of all, scripting support for Perl/Python.

It's $99, but I've easily saved 1000x that amount by being able to quickly script shell interactions that don't easily lend themselves to the regular scripting tools like 'expect'.

I think the best example was where a distributed cache cluster was dirtied during a deployment. Dumping the entire 100TB+ of good data was not an option, it would have taken days to warm back up. The cache admin tool had a menu system and wouldn't buffer input, so I couldn't just dump a buffer of commands into it and wait for it to finish.

I was able to lookup recently accessed DB rows in SSH tab #1, compare them to the cache in tab #2, and invalidate in another in tab #3. Problem solved in <20 minutes. We eventually built an app to invalidate dirty cached results, but that took about a week to do it the right way.

gcb0vor 13 Jahren

yeah, because managing windows is not the problem a window manager would be responsible for... what then? you have a dozen word documents? and a dozen text files? and a dozen images? ... do you keep changing your tools everytime you pass a window number threshold?

just get rid of windows 8. as troll as this comment may sound...

taspeotisvor 13 Jahren

just get rid of windows 8

I'm not aware of the grouping functionality changing between 7 to 8, at least to the extent that 8 doesn't group more aggressively than 7.

In both operating systems you can customise whether applications are grouped or not.

And although it's not necessarily PuTTY's job to change because of a new feature in the OS (taskbar grouping), I'd note that there is an API for controlling it [1].

[1] http://blogs.msdn.com/b/oldnewthing/archive/2012/08/20/10341...

gcb0vor 13 Jahren

in win8 if you are using a metro application you can't switch to a specific window right away in all the ways you can with windows 7. at least not in the old build i used.

taspeotisvor 13 Jahren

I can't disagree, but I doubt that if you're using PuTTY you're using Metro.

dwnvor 13 Jahren

metro is built in. there is no "not using metro"

thezilchvor 13 Jahren

Get rid of it for what? This is purely a troll; you offered no solution. I can't even imagine what you're referring to; is OSX or Ubuntu going to make managing my windows any better?

Note: I'm well aware of workspaces, but that can't be what you're referring to, as they are available to Win users, and it's not clear the OP is looking for anything more than tabs, which a WM isn't generally providing.

likeclockworkvor 13 Jahren

Linux is bigger than Ubuntu. There are Linux WMs that are FAR beyond what's available in Windows or OSX.

thezilchvor 13 Jahren

Obviously. Nothing you said is helpful to the OP or helps to support the post I replied to. Not to mention, Windows has numerous windowing or window tiling managers [0]; the Linux elitism is not helpful, especially when grossly misinformed.

[0] http://en.wikipedia.org/wiki/Tiling_window_manager#Microsoft...

eruvor 13 Jahren

Thanks, I didn't know about these. (I am stuck with Windows at work..)

eruvor 13 Jahren

> Get rid of it for what? This is purely a troll; you offered no solution. I can't even imagine what you're referring to; is OSX or Ubuntu going to make managing my windows any better?

Try XMonad on Linux. It does allow me to manage my windows better.

thezilchvor 13 Jahren

I feel like a broken record. The OP uses windows. The comment I replied to insists Windows is garbage and the OP should jump ship, because there's no hope for Windows managing windows. It's ludicrous to suggest Linux to OP, when he simply wants to manage his PuTTY windows differently (Re: his WM technically already manages the windows [grouping], but it's not what he wants); it is made more ludicrous by the fact that there exist tiling window managers for Windows -- see my other comments to SIBLINGS of your's.

Not that a tiling manager is going to be of ANY help in OP's case; I really doubt the auto-scaling and tiling of his windows is what is making him struggle with dozens of PuTTY instances.

gcb0vor 13 Jahren

if he's using win8 i'm pretty sure his only option is win7...

derlethvor 13 Jahren

You can run any WM Linux has on Ubuntu. I've heard good things about evilwm and have personally used ratpoison. They're both in the repository I'm sure.

thezilchvor 13 Jahren

I thought it'd be obvious I was speaking generally; suggesting "any WM" to the OP is still not helpful. Windows has just as many "any WM," so I really don't know your point.

derlethvor 13 Jahren

> Windows has just as many "any WM,"

No. It doesn't. Windows has one GUI and various themes for it; Ubuntu has multiple GUIs. That's what a WM is in Linux terms: A whole new GUI that sits on top of very basic graphical primitives which don't determine anything about how a GUI looks or works.

rschmittyvor 13 Jahren

It more than sounds a troll comment lacking any thought.

That's like saying tabs should not be in Chrome/FF and Windows/OSX/Linux flavor should handle all of your browsing windows just fine.

Things like tmux would also be a bad thing in your world, the window manger should handle this!

GP needs a putty manager (many exist) and will solve his needs. Much like other programs across multiple OS's solve the same need

fraqedvor 13 Jahren

If you right-click the taskbar and select properties you can choose the grouping behavior from Always, When Full or Never. You can also change the size of the taskbar buttons to small if you don't prefer the default.

Dylan16807vor 13 Jahren

You can turn off the combining but you can't turn off the grouping. (unless 8 reverted what vista/7 did)

Also annoying is that your only options are 'combine, without text' and 'don't combine, with text'. Why is windows so fond of using one toggle where there should be multiple toggles?

ereckersvor 13 Jahren

I've used Putty Connection Manager for tabbed management of multiple Putty windows for a few years now. Here's an older article about it:

http://www.thegeekstuff.com/2009/03/putty-extreme-makeover-u...

Unfortunately the URL for the download is down at the moment. I know, inspiring, but here it is:

http://puttycm.free.fr/

It can be found on the Putty "links" page under "Multiple connection" here (along with some other options):

http://www.chiark.greenend.org.uk/~sgtatham/putty/links.html

I used to use SecureCRT until I got tired of their weird format for private keys (not sure if that's still an issue since I stopped using it a few years ago).

Anyways, for what I was looking for Putty Connection Manager worked fine. Open many connections and cycle through the tabs with CTRL+TAB.

alan_cxvor 13 Jahren

Disable the grouping?

Properties, Taskbar buttons, Never combine.

WalterGRvor 13 Jahren

That doesn't turn off grouping, it turns off combining.

Grouping puts taskbar entries from the same app next to each other.

Combining turns multiple entries for the same app into 1 entry. To select a particular window, you have to hover over or click the combined entry - which causes large thumbnails of each of the combined windows to be displayed, then click the appropriate window thumbnail.

eCavor 13 Jahren

mRemoteNG gave me my sanity back: http://www.mremoteng.org/

be-preparedvor 13 Jahren

You can disable grouping, change the size of task bar, etc. I guess nowadays "hackers" prefer to bash Windows on HN, rather than learn how to use it effectively ...

laaczvor 13 Jahren

Little late to the party, but I did not find a way to paste from clipboard when using windows and Apple keyboard. Insert key is not working, so ctrl/shift+ins won't work. In putty pasting is done via right mouse click.

pronoiacvor 13 Jahren

I like MTPuTTY - http://ttyplus.com/multi-tabbed-putty/ - and I'm curious if you used this or another version.

Yhippavor 13 Jahren

The Chrome SSH client is close to becoming very useful for me. I stopped using it because IIRC you can only store a handful of connection credentials at a time.

foolfoolzvor 13 Jahren

I am probably a putty diehard... i love the simplicity of it. I get around this by using screen in just one putty window.

ape4vor 13 Jahren

Since putty.exe is so small you could make a bunch of copies. Launch putty1.exe for the first session, etc.

laumarsvor 13 Jahren

Duplicating the PuTTY binary for each session makes about as much sense as having a separate MS Office installation for each and every Word document.

ape4vor 13 Jahren

Except Word is huge and probably can't handle multiple installations. I admit its a hack.

laumarsvor 13 Jahren

It's not Word that would handle the multiple installations, it would be your HDD - since all that matters is the storage space you have available.

But that's moot as you'ed missed my point. I'm talking about how you only need one install of Word to open up multiple unique word documents. Just as you only need one copy of PuTTY to run multiple unique SSH sessions. duplicating the exe isn't a hack; it's just an unnecessary waste of disk space since you gain literally nothing (all the different exe's will point to the same registry keys for their profiles and all the exe's can run multiple instances).

And this is why I made my Word analogy - because what you're advising is worse than useless.

kin3ticvor 13 Jahren

bwblabsvor 13 Jahren

Some other projects who depend on PuTTY like FileZilla have new builds too: https://filezilla-project.org/

VMGvor 13 Jahren

Is there a client that has UTF8 as default and something different than the courier font?

gcb0vor 13 Jahren

It's two clicks after you install putty.

select Default, go change those two options (recommend the Mensch font, but that's purely personal). Go back to the sessions screen, save this as default.

done. now every session you create will have UTF8 and a decent font by default.

I also suggest you change scroll back to 999 or 9999. And change the color of bold blue to something readable.

bwblabsvor 13 Jahren

PuTTY beta 0.63 defaults to UTF-8 encoding and 2000 lines of scrollback (rather than ISO 8859-1 and 200).

VMGvor 13 Jahren

Those are actually more than two clicks and sadly enough to frustrate me every time.

There must be a fork with sane defaults out there somewhere.

elivor 13 Jahren

You could probably export a Registry file that has all your settings and then import on a new machine.

e12evor 13 Jahren

The last time I used windows a bit (I think it was around the Planetside 2 launch...), I noted down this:

# set up for putty: # From: http://mshnitzer.wordpress.com/2009/10/09/export-putty-setti... comment:

reg export HKCU\Software\SimonTatham putty.reg reg import putty.reg

I'm not sure what's the standard now, but I also always set "use ssh protocol v2 only" -- and you probably should too (on the off chance that you have some ancient device that doesn't handle version 2, you should probably make an exception in that profile).

foolfoolzvor 13 Jahren

if you are a putty user, do this. its very time consuming to set up putty especially colors but its easy to keep all your settings in a reg file.

voltagex_vor 13 Jahren

The fork I'm just about to patch is FuTTY - https://github.com/FireEgl/FuTTY which includes save-settings-to-file. The screen resizing behaviour (as a result of Screen's +flow command) might drive you crazy though.

Mindless2112vor 13 Jahren

UTF-8 is the default as of v0.63 [1].

[1] http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.ht...

megaman821vor 13 Jahren

As an alternative to PuTTY, MinGW with the OpenSSH package has been great.

ereckersvor 13 Jahren

I was using Putty Connection Manager (puttycm) to allow for tabbed browsing of multiple windows, and after upgrading Putty I now get issues. Loads nothing but a grey screen.

I'm working my way through it, but just wanted to pop in to see if anyone else had an issue.

Circling back. Here's the solution:

=> open Putty Connection Manager

=> select Tools > Options

=> select Plugins > Putty

=> select "Enable additional timing for PuTTY capture (ms): set to 300ms

=> select Apply & OK

voltagex_vor 13 Jahren

I wonder if the diff will apply cleanly to Futty/PuTTYTray - they're still based on a 2012 build of 0.62.

Edit: Blergh, SVN.

ilikejamvor 13 Jahren

PuTTY's pretty much relegated to the emergency usb key these days. Runs on pretty much any Windows and without installing, but not really ideal for heavy use imho.

Cygwin + urxvt + clusterssh is the choice of Windows-mandated champions.

georgiecaseyvor 13 Jahren

If anyone is looking for a Putty alternative, check out ZOC. It's great but it costs money.

caoimhinvor 13 Jahren

It's 2013. Why the fuck is anyone still using Windows?

kyrravor 13 Jahren

I know this is a troll statement, but I feel Windows does a lot of things well.

* For large organizations, domain controls make managing a large number of desktops much easier.

* I feel MS Office on windows is a better product than the mac version (if you do a lot of document work).

* Gaming. Windows is still dominant for desktop games.

* Windows isn't the walled garden that Mac is going towards.

* Backwards compatibility. Software written 10+ years ago for Windows still has a good chance of working on Windows 8.

* Familiar. People are used to it. I'm not going to force my parents to learn a Mac and all the weird behaviors that go with it.

* Isn't tied to hardware only made by Microsoft (which makes hardware a commodity).

I'm sure there are a number of other points I'm missing, but it's the ones that I like. But there are a number of things I really dislike about it:

* It's not unix based. So the filesystem layout differs, I can't share perl/bash scripts as easily across them. / vs \ for filesystem paths. EOL characters in ascii files.

* It took too long to get a good command line. Powershell is nice, but just too different than what I'm used to with Bash that I get on OSX and Linux.

* Many developer tools today are becoming OSX focused. Windows has a lot of great software still, but many of the smaller nitch tools that I discover are OSX or Linux focused.

marcosdumayvor 13 Jahren

> For large organizations, domain controls make managing a large number of desktops much easier.

The Unix way of putting the resources on the network, and synchronizing /etc works quite well. I've never seen anybody actually claim that AD is better than it. Most people complaining that the unixes don't have administration tools just want them to work like Windows.

Windows is a hell to administer, you can't just clone machines and you can't centralize your resources. You must do what AD allows you, and beg that this time something won't break, because you can't really test anything.

tenevor 13 Jahren

Would you mind explaining what domain controls offer? I've never worked with a large windows desktop install base, so I have no idea what domain controls do exactly.

jiggy2011vor 13 Jahren

A "Domain Controller" is basically a server that has authority for a domain. A domain in Active Directory is really the same thing as a "normal" internet domain (in fact is uses DNS) in that it can have sub domains where authority can be delegated to other DCs etc.

Each domain can have a collection of resources such as other servers and printers/storage etc. So once you authenticate against the domain controller (usually by logging into a computer using a pattern like \\Domain\Username rather than just username) you get a secure signed "token" back from the DC.

This token can be sent to other computers on the network that are members of the domain (or sent to web apps via a cookie) and it will identify the user as a member of that domain and also provide information as to what levels of access should be allowed without having to authenticate separately with each system.

That's kind of hand wavey though and Active Directory provides too many features to be enumerated here.

http://en.wikipedia.org/wiki/Active_Directory

adestefanvor 13 Jahren

The big win is Group Policy. You can centrally control every single option, including many applications, for every single Windows system on the domain. It's like puppet on steroids and HGH.

ericcolemanvor 13 Jahren

I'm a nix guy, but I believe it's for dealing with setting/managing authentication, authorization, permissions, etc.

porkervor 13 Jahren

> * I feel MS Office on windows is a better product than the mac version (if you do a lot of document work).

Absolutely. I wonder if the MS Office for OSX team ever tried using it, or exchanging documents between Windows and OSX. The different epoch startdate in Excel on both platforms... bleurgh.

The crappiness of Office for Mac is 50% of the reason I have a VMWare Windows box (the other 50%? Testing websites on IE9)

[deleted]vor 13 Jahren

bitopsvor 13 Jahren

Many of the world's largest companies still run Windows and are heavily invested in it. Also, many admin tools (even for Unix-based services) are written for Windows, because IT admins have to straddle both worlds.

Also, for all its ills, Windows is not a bad platform for most lay users. Yes, of course we've all been bitten by it, but if all you need to do is normal office work, it's not bad.

JohnTHallervor 13 Jahren

Because most of the world's work is still done on Windows.

induscreepvor 13 Jahren

Because Linux is good only when used from the command line, and Mac OS doesn't run on commodity hardware. That leaves only Windows as a viable option for most people.

arochvor 13 Jahren

Well, OSX does run on commodity hardware (often with little to no modification). It just isn't sold on non-Apple hardware and the EULA "forbids" it

falcolasvor 13 Jahren

IMHO - it has the best windowing system. Trivial perhaps, but it's the one huge thing that continuously bothers me about Ubuntu and OSX.

simoncionvor 13 Jahren

Give KDE (maybe on Kubuntu) a try. It's pretty easy to make it look and behave a lot like Windows, and alt-right-drag to resize and alt-left-drag to move windows have saved me like a couple thousand hours in fiddly work.

barbsvor 13 Jahren

I'd recommend Linux Mint with Cinnamon for the same reasons.

deadreturns2vor 13 Jahren

eruvor 13 Jahren

If it's only about the windowing system, you might want to try out a few X Window Managers on Linux. There's more than what comes out of the box with Ubuntu.

(I like tiling window managers like XMonad for example.)

mzrvor 13 Jahren

Its 2013. Why the fuck do you care what other people use? I'm suprised you didn't break out the 'Micro$haft Winblows!!', or are you saving that for later?

Sent from OS/2

ladzoppelinvor 13 Jahren

Pro audio and now, with the direction Apple is going with the Apple Pro/Final Cut, pro video.

nucleardogvor 13 Jahren

What does that have to do with anything? PuTTY is not windows-exclusive.

tenevor 13 Jahren

Putty on linux has been very useful to me several times, when preparing screenshots for documentation for windows users.

barbsvor 13 Jahren

What are the benefits of using PuTTY over plain ssh in a *NIX environment?

eruvor 13 Jahren

Putty has nice nethack support.

cafvor 13 Jahren

You can also run nethack under 'cp437' (https://github.com/keaston/cp437) to use the IBMGraphics option on a UTF-8 terminal like gnome-terminal.

tigerweedsvor 13 Jahren

just out of curiosity: what are you using?