Secure Shell (SSH) [SSH]

Secure Shell (SSH) is a cryptographic network protocol for secure remote login, command execution and file transfer over an untrusted network.

How SSH works

Finnish researcher Tatu Ylönen created SSH in 1995 after a password-sniffing attack on his university network. It replaced insecure protocols such as Telnet and rlogin, which sent passwords in clear text. The current version, SSH-2, is defined in RFC 4251–4254, and OpenSSH, developed by the OpenBSD project since 1999, is the most widely used implementation. SSH servers typically listen on TCP port 22.

• The client verifies the server’s host key, and both sides agree on session keys using key exchange.
• The user authenticates with a password, a key pair based on public-key cryptography (for example Ed25519), or SSH certificates.
• The encrypted channel carries shell sessions, file transfers (SFTP, SCP) and port forwarding tunnels.

Why SSH matters for security

SSH is the standard way to administer Linux servers, network devices and cloud instances, which makes it a prime target:

• Brute force – botnets constantly try common passwords against exposed SSH servers (see brute force).
• Stolen keys – unprotected private keys and over-trusted authorized_keys files enable lateral movement across servers.
• Vulnerabilities and backdoors – the 2024 xz Utils backdoor (CVE-2024-3094) targeted OpenSSH servers on some Linux distributions through a compromised library, and regreSSHion (CVE-2024-6387) allowed remote code execution in OpenSSH on glibc-based Linux.

Best practices

• Use key-based authentication with passphrases and disable password and root logins.
• Do not expose SSH directly to the internet; use a VPN or bastion host and allowlists.
• Rate-limit login attempts with tools such as fail2ban and add MFA for critical hosts.
• Keep OpenSSH updated and regularly review authorised keys.