SSH (Secure Shell)

SSH (Secure Shell) is a network protocol used to securely access and manage remote systems over an unsecured network.

SSH provides encrypted communication and secure remote authentication, which is safer than telnet and other insecure alternatives.

SSH commonly secures remote terminal access, file transfer, tunneling, and port forwarding.

The default SSH port is 22.

The SSH client is the application that connects to a remote SSH server, such as ssh on Linux or PuTTY on Windows.

The SSH server is the daemon listening for incoming SSH connections, often sshd.

SSH encrypts the communication channel between the client and the remote server, including terminal sessions and data transfers.

SSH is designed mainly for remote shell access and secure command execution. TLS is commonly used for securing HTTP, mail, and other application protocols.

A key pair is used to authenticate securely without sending a password over the network.

A private key is kept secret on the client machine and used to prove identity.

A public key is shared with the server and used to verify the private key without exposing it.

Asymmetric encryption uses a pair of keys: public and private. Data encrypted with one key can only be decrypted with the other.

Authentication is the process of proving the identity of the client to the server.

Common methods include:

• password authentication
• public key authentication
• host-based authentication
• keyboard-interactive authentication

Password authentication sends a password to the server and verifies it against the system account.

Public key authentication verifies that the client owns a matching private key, without sending a password.

It is more secure and more convenient than password login, especially for automation and remote administration.

ssh-agent stores private keys in memory so they do not need to be entered repeatedly.

ssh-add loads private keys into the SSH agent for reuse.

The SSH config file allows predefined connection settings such as host aliases, ports, and identity files.

On Linux/macOS: ~/.ssh/config

known_hosts stores the host public keys previously seen by the client, helping detect MITM attacks.

Host key verification confirms the server is the same server the client expects, based on known host fingerprints.

A fingerprint is a cryptographic hash of a public key used to quickly compare keys.

SSH port forwarding creates a tunnel that redirects traffic through an encrypted SSH connection.

Local port forwarding sends traffic from a local port to a remote destination through the SSH tunnel.

Remote port forwarding sends traffic from a remote SSH server port to a local destination.

Dynamic port forwarding uses SSH as a SOCKS proxy for many outgoing connections.

An SSH tunnel creates a secure communication path between endpoints using SSH as the transport.

SOCKS is a proxy protocol used by clients to send traffic through a tunnel, often for browsing or application-level routing.

scp copies files securely between hosts over SSH.

sftp provides secure file transfer using the SSH protocol.

rsync can use SSH as the transport for encrypted backup and synchronization.

A common form is: ssh user@hostname

Example: ssh -p 2222 user@host

Example: ssh -i ~/.ssh/id_rsa user@host

It enables verbose output, helping diagnose SSH connection issues.

It compares the server’s public key fingerprint with a trusted value to verify identity.

The SSH daemon is the service running on the server that accepts incoming client connections.

sshd_config is the SSH server configuration file.

ssh_config is the client configuration file.

A remote shell is a command-line interface opened on a remote machine through SSH.

Remote administration means managing a server through network commands, often over SSH.

Passwordless authentication uses keys instead of passwords for login.

A server can challenge the client for proof of possession of a key or credentials without sending a password.

Shell escaping ensures special characters are correctly passed to the remote shell.

Because SSH encrypts the session, protecting sensitive credentials and command output.

SSH is a secure remote access protocol, not to be confused with SFTP or SCP, which are higher-level utilities.

Yes. SSH can tunnel app traffic, making it useful for secure access to internal resources.

A bastion host is a hardened server used as an entry point to a private network.

It provides controlled access to private environments without exposing all services publicly.

A jump host is another term for a bastion or intermediate host used to reach private servers.

A passphrase protects the private key with an additional encryption layer.

It adds another layer of protection if the private key file is stolen.

The SSH agent can unlock a private key once and reuse it without repeated password prompts.

A shell prompt is the command-line interface shown after login.

ssh-keygen generates SSH key pairs.

Common SSH key types include:

• RSA
• ED25519
• ECDSA

It is fast, secure, and efficient, and is widely recommended for modern systems.

The authorized_keys file contains public keys allowed to log in to a user account.

By default on Linux/macOS: /.ssh/id_rsa or /.ssh/id_ed25519

Proper file permissions prevent unauthorized access to private keys.

Typically 600 (or 400 if stricter).

Usually 700.

Shell access means the user can run commands on the remote system through an interactive session.

A non-interactive SSH session can run a single command remotely.

This runs a remote command without opening an interactive shell.

Remote execution means running commands on a machine over SSH.

SSH is widely used by automation tooling to deploy, configure, and manage systems.

SSH is commonly used to provision servers, run scripts, and orchestrate infrastructure.

Telnet sends data in clear text; SSH encrypts it.

Because credentials and commands can be intercepted.

ssh-copy-id uploads a public key to a remote server’s authorized keys.

A fingerprint mismatch usually means the server key changed or a MITM attack is occurring.

It means the SSH server key on that host differs from the one stored in known_hosts.

It may indicate a server rebuild, impersonation attempt, or configuration issue.

The host key identifies the server to clients and prevents impersonation.

A server has a private host key and a public host key used for SSH identity verification.

This is the key pair the user uses to authenticate to the server.

Host keys identify the server. User keys identify the client.

GSSAPI authentication uses Kerberos or similar mechanisms for identity management.

It provides encrypted transport for remote copy operations and secure automation.

Example: ssh host "uptime"

SSH multiplexing reuses an existing SSH connection to run multiple commands more efficiently.

ControlMaster allows multiplexing multiple SSH sessions over one master connection.

X11 forwarding allows a remote graphical application to display locally through SSH.

It has security implications and is less commonly used than remote CLI tools.

You can create a tunnel through SSH to access a database on a private network securely.

Reverse SSH connects from a machine behind NAT back to a reachable SSH server, allowing remote access.

Secure file transfer means copying files without exposing them to sniffing or tampering.

Both are secure file transfer protocols over SSH. sftp is more feature-rich and interactive; scp is simpler.

SSH is frequently used to access EC2, VM, and container hosts securely.

A container runtime may expose a shell over SSH for remote administration or debugging.

Because it increases attack surface unless properly secured and monitored.

Hardening means limiting access, disabling root login, enforcing key-based auth, and restricting users.

It reduces direct administrative attack paths and enforces least privilege.

Least privilege means granting the minimum required permissions to a user or service.

Only allow the users who need SSH access and restrict them to required commands or hosts.

A locked-down policy may include:

• key-only auth
• no password login
• no root login
• firewall restrictions
• two-factor authentication

It requires something you know and something you have, such as a password and a hardware token.

SSH commonly uses version 2, known as SSH-2, which is the modern secure implementation.

The SSH transport layer provides encryption, integrity, and host authentication.

This layer handles user authentication after the secure transport channel is established.

The connection layer multiplexes multiple channels, such as shell, SFTP, ports, and forwarding.

SSH channels are multiplexed logical communication streams over a single connection.

It allows one SSH connection to carry multiple independent streams efficiently.

It creates a local tunnel without opening an interactive shell.

It creates a remote port forwarding tunnel.

TCP tunneling wraps TCP traffic inside an SSH connection; SSH is the transport for the tunnel.

Port binding creates a listening socket at a local or remote endpoint for forwarded traffic.

It is the address used to listen on local forwarded ports, often 127.0.0.1.

It is the address used on the remote SSH server for a remote port-forwarded port.

Loopback restricts access to the local machine, reducing external exposure.

SOCKS5 is a common proxy protocol that supports dynamic port forwarding and authentication.

sshuttle is a tool that creates VPN-like tunnels through SSH for routing traffic.

It stores trusted server host keys and prevents naive man-in-the-middle attacks.

The client compares the host key fingerprint to the stored expected key.

Host key rotation means generating a new server host key and updating clients’ known_hosts entries.

SSH key rotation means replacing user or host keys after a compromise or policy change.

Because stale keys may be exposed or become outdated.

Example: Host prod-hop ~ HostName bastion.example.com~ ~ User ubuntu~ ~ IdentityFile /.ssh/bastion_key Host prod-server ~ HostName 10.0.0.10~ ~ User admin~ ~ ProxyJump prod-hop~

ProxyJump allows SSH to connect through an intermediate host automatically.

It allows custom tunneling or jump logic when ProxyJump is insufficient.

SSH agent forwarding allows the remote server to use your local SSH agent for further SSH connections.

It is powerful but can be dangerous if the remote host is compromised.

Use: ssh -A to enable and omit -A or set ForwardAgent no in config.

It groups connection settings for hosts matching a pattern.

It controls behavior when the host key is unknown or changed.

Common values:

• yes
• no
• accept-new

It enforces validation instead of accepting unknown or changed hosts silently.

It specifies a custom file for known host keys.

Compression reduces payload size, which may help performance for slower links.

Because it may hide characteristics or add CPU overhead, but it is not usually a major security problem.

SSH session logging records connection metadata and terminal output for auditing and troubleshooting.

Auditing reviews SSH access, keys, logs, and configuration for security compliance.

You can restrict which users can log in via SSH through minimal ACLs and OS-level permissions.

You can restrict an SSH key to run only a specific command on a remote server.

The server can define a command that must run after successful key authentication, even if the user requests another command.

A restricted key is a key that can only perform some permitted operations.

It reduces risk when a key is compromised or misused.

It stores a passphrase in the agent to avoid repeated prompts.

A jump box is a machine that a user connects through before reaching more restricted systems.

Examples:

• disable password login
• require key-based auth
• restrict to selected users
• require MFA

Multi-factor authentication adds another verification step beyond the key or password.

PAM (Pluggable Authentication Modules) allows SSH to integrate with system authentication frameworks.

They can restrict what the SSH process and users can do after login.

Interactive SSH opens a remote shell. Non-interactive SSH runs one command or script and exits.

SSH uses symmetric encryption for data and asymmetric crypto for key exchange and authentication.

Key exchange is the process of agreeing on a shared secret used to encrypt the session.

Diffie-Hellman is a widely used key exchange algorithm used to establish a shared secret securely.

A symmetric session key is generated and shared by both sides to encrypt traffic after key exchange.

They are faster and more efficient than asymmetric encryption for bulk data.

MAC (Message Authentication Code) ensures integrity and authenticity of transmitted data.

Because they provide confidentiality, integrity, and authenticity.

The session ID is a unique identifier for the authenticated session, used for tracking and debugging.

A client opens a channel, performs traffic, then closes it when done.

A shell session is the interactive remote terminal.

CI systems often use SSH to deploy services or run scripts on remote machines.

If commands are not properly escaped, harmful remote commands can execute.

Because user input may contain shell metacharacters or unintended commands.

It ensures strings are interpreted literally and not as shell code.

It means using minimal privilege, strong identity, monitored access, and encrypted channels.

SSH is the standard method for remote Linux system administration.

It is a framework for controlling who can access sensitive systems and what they may do.

This directive controls whether root logins are allowed over SSH.

This controls whether password-based SSH login is allowed.

This controls whether public key authentication is enabled.

This forwards GUI windows for remote applications through SSH.

AllowUsers restricts SSH access to a specific set of usernames.

DenyUsers blocks SSH access for specific users.

AllowGroups restricts SSH logins to members of selected groups.

This defines whether empty passwords may be used; it should usually be disabled.

Port knocking is a technique to hide a service by making it appear only after a sequence of connection attempts.

To restrict access to only trusted IPs, VLANs, or bastion hosts.

A host allow list is a list of clients or subnets allowed to connect to SSH.

Use a bastion host to enter private networks, then SSH from there to internal servers.

Because configuration, user management, key hygiene, and network controls are equally important.

If one system is compromised, the attacker may access multiple systems.

• unique keys per system or purpose
• short key lifetimes
• regular rotation
• revocation policies
• safe storage

Revocation invalidates compromised or stale credentials.

Modern SSH uses strong algorithms like:

• curve25519-sha256
• chacha20-poly1305
• aes-256-gcm
• Ed25519 keys

It offers strong security with good performance and compact keys.

KEX (Key Exchange) establishes the shared session secret securely.

The cipher encrypts the actual session payload.

The MAC ensures message integrity and authentication.

Confidentiality hides the content. Integrity ensures data was not modified.

It uses MACs over encrypted packets.

Some CBC-based encryption modes are susceptible to padding oracle and side-channel issues; modern SSH uses better authenticated modes.

They provide confidentiality and integrity simultaneously while reducing implementation errors.

Post-quantum cryptography refers to cryptographic algorithms designed to be resistant to quantum attacks.

It may be eventually affected, so migrations to quantum-resistant algorithms may matter in the future.

Weak key exchange can allow passive attackers to recover session secrets in some attack models.

A timing attack exploits differences in execution time to infer secret information.

By using well-hardened libraries and constant-time operations where relevant.

Host key pinning ensures a client trusts a specific host key or set of keys instead of just any matching key.

A man-in-the-middle attack intercepts communication between the client and server and impersonates each side.

It verifies server host keys against known trusted values.

Trust establishment means verifying an SSH public key is authentic and belongs to the intended server or user.

OpenSSH is the most common, but many libraries and clients implement SSH using robust cryptographic primitives.

Because it is one of the main secure administrative channels for servers, devices, and remote systems in modern infrastructure.

Balancing operational convenience against security policy, without creating friction or breaking automation.

A secure remote access architecture often includes:

• bastion hosts
• user keys only
• no root login
• MFA
• logging and alerting
• source IP restrictions

Privilege separation isolates the privileged SSH process from user session execution to reduce impact if it is compromised.

A chroot jail can isolate a user session to a restricted filesystem.

SSH lockdown often includes centralized identity providers, key management, MFA, and controlled auditing.

SSH key management includes generation, storage, rotation, distribution, revocation, and auditing.

Centralization reduces key sprawl, makes rotation manageable, and improves auditability.

Passwordless login improves security and automation but requires careful key handling and monitoring.

Some enterprises integrate SSH with LDAP, Kerberos, or IAM systems to centralize access control.

It means only allowing the exact users and commands needed for a role, not broad unrestricted shell access.

Recording terminal sessions provides accountability and helps with security investigations.

Because administrative access is high risk and should be traceable.

Examples:

• password login enabled
• root login allowed
• weak algorithms enabled
• too-broad authorized_keys permissions
• open SSH to the internet without IP restrictions

It raises risk of credential guessing, brute-force attacks, and password leakage.

Because port 22 is exposed on many internet-connected systems and attackers scan continuously.

fail2ban can block clients after repeated failed SSH login attempts.

By disabling passwords, restricting users, using firewalls, and limiting login sources.

An SSH honeypot is a decoy system designed to attract attackers and collect evidence.

It combines access restrictions, strong auth, network segmentation, and auditing.

Because it remains the most reliable and secure standard for remote machine administration and automation.

The future brings stronger defaults, stricter policies, better key management, and continued integration with identity and policy systems.

Remote access is a critical trust boundary. SSH must be designed with strong authentication, least privilege, and careful monitoring.