What Is SSH and How Does It Work?

This guide provides an overview of Secure Shell (SSH), detailing how the protocol functions, the core cryptographic methods it relies on, its common applications in system administration, and key security practices for remote machine management.

Understanding Secure Shell

Secure Shell, commonly abbreviated as SSH, is a network protocol that allows users to access, control, and modify remote computers and servers securely over an unsecured network. Developed in 1995 by Tatu Ylönen as a replacement for unencrypted protocols such as Telnet, rlogin, and rsh, SSH encrypts all transmitted data—including passwords, commands, and terminal output—preventing eavesdropping, connection hijacking, and man-in-the-middle attacks.

For detailed protocol specifications and reference guides, visit the SSH documentation.

How SSH Operates

SSH operates on a client-server architecture, typically using TCP port 22 by default. The SSH client initiates an encrypted connection with the remote SSH server, following a multi-stage handshake:

  1. Host Verification: The server presents its public host key to the client. If the client has connected previously, it matches the key against its local known_hosts registry to confirm the server's identity.
  2. Session Key Negotiation: Using asymmetric encryption algorithms (such as Diffie-Hellman key exchange), both systems generate a shared symmetric key used exclusively for encrypting traffic during that specific session.
  3. User Authentication: Once the encrypted tunnel is established, the user proves their identity to the server through credentials such as passwords, multi-factor authentication, or asymmetric cryptographic key pairs.

Authentication: Passwords vs. SSH Keys

While password authentication is widely supported, cryptographic key-based authentication represents the industry standard for securing SSH access.

An SSH key pair consists of:

  • Private Key: Stored securely on the user’s local machine with restricted file permissions (e.g., chmod 600) and often protected with a passphrase. It is never transmitted across the network.
  • Public Key: Placed on the remote server inside the user's ~/.ssh/authorized_keys file.

When a login request occurs, the server issues a challenge encrypted with the user's public key, which can only be solved and verified if the user possesses the matching private key. Common algorithms for generating these key pairs include ED25519 and RSA (at minimum 3072 bits).

Core Use Cases of SSH

  • Remote Command Execution: System administrators use SSH to log into servers, navigate directory structures, manage system services, and execute administrative utilities.
  • Secure File Transfer: Protocols built on top of SSH, such as SFTP (SSH File Transfer Protocol) and SCP (Secure Copy Protocol), facilitate encrypted file transfers between endpoints.
  • SSH Port Forwarding and Tunneling: SSH can encapsulate unencrypted network traffic by creating encrypted tunnels between local ports and remote destinations, frequently used to access internal databases or proxy web traffic.
  • Automated Deployment and CI/CD: Automation pipelines rely on SSH keys to execute deployment scripts, configure cloud virtual machines, and manage container fleets without manual intervention.

Essential Security Practices

  • Disable Root Login: Restrict direct root login via the PermitRootLogin no directive in /etc/ssh/sshd_config, requiring administrators to log in as standard users and elevate privileges using sudo.
  • Enforce Key-Based Authentication: Disable password authentication entirely (PasswordAuthentication no) to eliminate the risk of brute-force password guessing.
  • Change Default Port (Optional): Moving the SSH listening port away from port 22 reduces noise from automated internet scanners.
  • Implement Rate Limiting: Tools such as Fail2ban automatically block IP addresses that exhibit repeated failed authentication attempts.