What is SSH?

Introduction

When accessing a computer over a network, system administrators need a secure connection to hide from malicious cyber-attacks, such as password-sniffing. As large networks have security flaws, encryption protocols such as TLS/SSL, IPsec, S/MIME, PGP, and SSH are necessary to ensure necessary protection.

This article provides an overview of the SSH protocol – its function, terminology, and use cases.

What Does SSH Mean?

The acronym SSH stands for “Secure Shell.” The SSH protocol was designed as a secure alternative to unsecured remote shell protocols. It utilizes a client-server paradigm, in which clients and servers communicate via a secure channel.

The SSH protocol has three layers:

• The transport layer. Ensures secure communication between the server and the client, monitors data encryption/decryption, and protects the integrity of the connection. It also performs data caching and compression.
• The authentication layer. Conducts the client authentication procedure.
• The connection layer. Manages communication channels after the authentication.

The channel created by SSH uses public-key cryptography to authenticate the client. Once the connection is established, SSH provides an encrypted way to exchange information safely regardless of the underlying network infrastructure.

SSH was designed for Unix-like operating systems, such as Linux, macOS, and BSD. However, it is also works on Windows.

A Brief SSH History

SSH was created by Tatu Ylönen in 1995. The protocol was designed to prevent password-sniffing attacks at the Helsinki University of Technology. The first version of the protocol, now called SSH-1, was designed to replace unsecured protocols such as rsh, rlogin, and Telnet. It started as freeware but soon became proprietary software.

After Ylönen’s SSH-1 became a popular tool worldwide, the Internet Engineering Task Force (IETF) assembled a group whose purpose was to develop a successor to the protocol. In 2006, SSH-2 became a new standard, featuring security improvements such as Diffie-Helman key exchange.

The open-source community developed OSSH, an SSH protocol version based on version 1.2.12 of SSH-1. The OpenBSD developers later forked OSSH to create OpenSSH, the most popular SSH implementation in the world today. As of version 7.6, OpenSSH supports only SSH-2. The support for SSH-1 has been discontinued.

SSH Terminology

The following table contains some terms you may encounter when working with SSH:

SSH Uses

SSH is widely used in data centers to provide secure management, remote access to resources, software patches, and updates. The protocol also enables protected router management, server hardware maintenance, and virtualization platform administration.

Due to ease of use, robustness, and numerous features, SSH can be applied in various scenarios.

These scenarios include:

• Connecting to a remote host.
• Backing up, copying, and mirroring files using SFTP.
• Mapping a client’s port to the server’s port to secure TCP/IP and other network protocols.
• Forwarding X Window System from the server to clients.
• Tunneling sensitive data through a secure channel.
• Using a Virtual Private Network.

SSH keys are often employed in automating server access with passwordless login, configuration management, and backup.

How to Use SSH?

Connecting to an SSH server is performed using an SSH client. Most Unix-based and Unix-like operating systems come with the daemon and the client preinstalled. On these systems, the SSH client is available in the terminal.

To connect to a remote host using the terminal, the user issues the ssh command followed by the username and the server address or hostname:

ssh [username]@[server_ip_or_hostname]

For example:

Windows 10 offers OpenSSH client and server as of version 1709. Earlier versions of Windows did not include SSH as a feature, so tools such as PuTTY were used to establish an SSH connection. PuTTY is an SSH client with a GUI for SSH and Telnet:

Some other popular SSH clients for Windows include:

• Bitvise
• WinSCP
• KiTTY
• Solar-PuTTY
• SmarTTY

How Secure is SSH?

When used with standard security precautions, the SSH protocol is considered to be highly secure. However, human factors play a significant role in maintaining the security of SSH connections.

Brute force attacks on SSH servers are a common scenario. Attackers attempt to connect to a large number of SSH servers using common usernames and passwords. When they gain access to a server, they use privilege escalation to gain access to the root account.

SSH keys are recommended as a more secure authentication method than passwords. However, poor SSH key management still presents a significant risk to organizations whose critical information depends on keeping the keys secret.

While SSH keys offer better protection, their misuse can provide malicious individuals access to privileged information. This information includes accounts and resources, such as databases, routers, payment systems, etc.

Exposed SSH ports are another potential security weakness. Some malware programs attack IoT devices with ports exposed, using them as a backdoor entrance to the local network.

Lastly, a large number of SSH clients on the market means that the security of the protocol also depends on the security of third-party apps.

Conclusion

This article provided a rundown of the SSH protocol, its history, features, and use cases.

If you are interested in security solutions for your server, read 21 Tips to Secure Your Server.