Secure MobaXterm for your company

Mon, 16 Mar 2015 00:00:00 +0100

When you purchase MobaXterm Pro Edition, you get access to a registered copy of MobaXterm and another program called Customizer. Using MobaXterm Customizer, you will be able to generate customized copies of MobaXterm with your own logo and your default settings. Settings specified in the Customizer will be hard-coded within the generated executable itself.

We already discussed about MobaXterm customization in another article. We will now try to explain in details how to secure your MobaXterm installation for your company use.

MobaXterm is already a secure program: its SSH connections are based on the well-known OpenSSH program and encrypted using the OpenSSL library, its sources are available so that anyone can audit them, its passwords can be stored with strong encryption.

For home usage, MobaXterm default settings may be enough to ensure a decent security level. However, depending on your company security rules, you can disable some features which may be considered as unsafe in your professional environment.

In the Customizer program, go to the Settings tab, then to the Security tab.

Each setting can be leaved unchecked (less secure) or checked (more secure), you will have to make some choices between features and security.

For instance:

if users do not use any of the embedded servers, we recommend to check the Disable servers box: this will prevent your company users from starting one of the embedded MobaXterm daemons (SSH, telnet, VNC, HTTP, FTP, …)
if users do not need any network packet capture or network scanner / port scanner tools, we recommend to check the disable packet capture and disable network/ports scanner
you may also consider the possibility in your environment, to disable insecure protocols such as telnet, rlogin or ftp and use SSH / SFTP instead.

It is very important to be aware that MobaXterm is only a network client program and that restraining things on the client will not secure your network entirely: it is much more important to secure the server side of your network architecture. For instance, if you need to force your team members to use ssh instead of rlogin/telnet in order to access to a server: even if you restrain MobaXterm in order to prevent it from performing rlogin/telnet connections, if the server is still able to accept such protocols, your team members will still be able to download another network client and to perform insecure connections.

How to customize MobaXterm

Thu, 12 Mar 2015 00:00:00 +0100

In order to perform this operation, just launch MobaXterm_Professional_X.X.exe
After having entered your license key, you can select to customize your MobaXterm package. Then, you will have the following graphical interface:

MobaXterm customizer is based on a step-by-step process. You just have to select your parameters (or leave default settings) and select the Next button to proceed to the second step.

The different steps are described hereunder:

In this step you can configure the banner that will be displayed at MobaXterm startup. Of course, if you do not have special requirement about the banner, leave the default text, and select Next.

Step 2: Profile customization

In this step, you will have access to the default profile used at MobaXterm startup. This profile is the equivalent of the /etc/profile file on Linux operating system. If you are not familiar with profile principles, please keep the default profile and select Next.

Step 3: Settings customization

In this step, you will have a list of the different MobaXterm features. The customizer allows you to enable or disable these features. The settings allow you to remove games, screensaver or even disable insecure protocols such as RSH, Rlogin or Telnet. All these parameters will become the default settings of the generated MobaXterm application.

Step 4: Logo customization

In this step, you can choose to set your own logo for the MobaXterm startup and about windows. Just select Browse and pick a picture from your computer.

Step 5: Bookmarks customization

In this step, you will have the possibility to pre-define MobaXterm sessions. For example you can add SSH sessions and organize these sessions in different folders. After MobaXterm generation, users will have access to these pre-defined sessions. Please note that no password can be stored in the customizer.

Step 6: Plugins integration

In this step, you will have the possibility to add plugins to your MobaXterm customized package. In order to get plugins, please visit https://mobaxterm.mobatek.net/plugins.html and download the requested plugin. Then just add it thanks to the Browse button. Note that plugins have the file extension MXT3.

Step 7: Generate your customized copy / save settings

This step is the last step of the Customizer. The build function allows you to generate your own MobaXterm copy which includes all the settings chosen in previous steps.

From this step you can generate an installation package (MSI file) by clicking on Generate MSI button. You have also the possibility to create a customized portable version, by clicking on the Portable exe button

Finally you also have the possibility to save your customization settings and export them to a file, using the Save Customization button. This will allow you to open it later, or to keep it in order to apply the same settings on any further update of MobaXterm.

We will discuss about using the customizer in order to secure MobaXterm for your company in another article.

Pro on MobaXterm Blog