Secure Shell
ActiveCryptographic network protocol for secure remote login, command execution, and file transfer over unsecured networks.
In one line
SSH (Secure Shell) provides encrypted communication between a client and server over an unsecured network. Defined in RFC 4251–4256, it replaced Telnet and rsh by adding strong authentication, encrypted sessions, and secure port forwarding. SSH operates over TCP port 22 using a client-server model with public-key or password authentication.
Quick Reference
| Field | Size | Description |
|---|---|---|
| Protocol Version | Variable | Exchange of protocol version strings (SSH-2.0-OpenSSH_9.0) |
| Key Exchange | Variable | Negotiate algorithms, exchange keys using Diffie-Hellman or ECDH |
| Packet Length | 4 bytes | Length of the packet not including MAC or this field |
| Padding Length | 1 byte | Length of random padding appended to the payload |
| Payload | Variable | The actual data being transmitted |
| MAC | Variable | Message Authentication Code for integrity verification |
Key Characteristics
Encrypted
All traffic encrypted using AES-256, ChaCha20, or similar ciphers.
Authenticated
Public-key, password, or certificate-based authentication.
Multiplexed
Multiple channels (shell, file transfer, port forwarding) over one connection.
Port Forwarding
Local, remote, and dynamic (SOCKS proxy) port forwarding.
Implementations
Edge cases
- •Host key verification must be checked to prevent MITM attacks.
- •First-connection trust-on-first-use (TOFU) is a common misconfiguration risk.
- •Keep-alive settings needed for long idle sessions behind NAT.
- •SSH-1 is cryptographically broken and must not be used.
History
SSH was created by Tatu Ylönen in 1995 after a password-sniffing attack at Helsinki University of Technology. SSH-1 was released as freeware. SSH-2 was later standardized by the IETF in RFC 4251 (2006) with stronger security guarantees.