Making my G4 Mini wifi-secure?

Question

I have a couple of G4 Mac Minis each equipped BTO with Airport Extreme.
I'm soon going to be in a keyed wifi environment and I need to learn how to do what folks have recommended I do:
encrypt everything, use ssh, sfpt, ssl, and set up a VPN.
I barely understand what those all are, let alone know how to actually DO them...is there a spot online where I can get instruction or a tutorial on this?
Maybe I'll need some information from this wifi administrator to fully complete the set up, but I need to get crackin on the ABC's of settin 'er up so that I can be secure in my wifi security.
thanks for any links, tips, or pointers!
ray

Answer 1

Securing your mail, unless you are running your own server, is totally dependent on your email provider. For example, if your email provider has you enable SSL on your smtp and imap/pop, you're encrypted. A university that I used to attend was a bit more draconian than that. They didn't let you send mail through their server unless you were on their subnet. So at home I couldn't send it the usual way. But since the university supplied a (secure) shell account, I could tunnel smtp through ssh and login via ssh to my university shell account and then launch Mail and send email via their server via my tunneled ssh connection.
If you have a shell account anywhere that provides you with sftp or ssh command line access, whether they allow access via password authentication or public key exchange is up to the entity maintaining the ssh server. You, as the client, authenticate however they say to authenticate.
Doing online banking over the web for example, is using SSL so even an open wireless access point is okay for that because the "https" is encrypting that between you and the bank.
Your work may require you to use VPN (and they would therefore provide you with the VPN client program and tell you all the necesary client configuration so that you could connect to your work's LAN). One might make the analogy that VPN is, more or less, a "Cadillac" version of a "Chevrolet" ssh tunnel.
If you are running the "server," e.g. at home so you can connect to your home machine from afar, then YOU make the rules, and set up passwordless key-exchange-only ssh, tunnel VNC and AFP through it, forward port 22 on your home router to your home computer, enable remote login on your home Mac so you can connect to it from afar via ssh, enable personal file sharing so the internal "localhost" ports on your computer can let you do AFP sorts of things, and similarly for VNC and other services. Important point, with tunneling services, yes, you have to open the appropriate ports for each of those services on the Mac's firewall, but only need to open the single port for ssh/sftp on your router, and the public key only authentication scheme keeps you extremely safe. If you are running your own mail server, where random smtpp servers are trying to deliver email to your server for your server to distribute to your server's multiple mail accounts, that gets a little trickier, but it doesn't sound like you are doing or wanting to do that. Like I said, most of my previous drivel was thinking that you were wanting to be the server, not just do client activities.
And this is all independent of the wireless encryption. Like I said, if you're setting up a home wireless router using wireless encryption, just use WPA2 or WPA with a strong password to keep the freeloaders and hackers from affiliating onto your residential LAN and using your broadband internet access or trying to snoop around on computers that are rightfully affiliated to your residential LAN. If you don't control the wireless access point, then the person that does will tell you the channel protection scheme involved, and what its password is. And this only provides protection from your wireless laptop to the wireless access point. After your traffic leaves the wireless access point and hits the internet, the ssh tunnel, or SSL-wrapper around your mail/web traffic, or the VPN, is what protects your traffic from internet evildoers.