What Is SSH? A Complete Guide to the SSH Protocol

What is SSH?

SSH, also called Secure Shell, is a protocol that lets users remotely control, manage and edit a server over the Internet. Secure Shell provides an algorithm to authenticate the user, passes input from the client to the host and returns the result to the client. It replaces the unencrypted Telnet program and uses cryptographic techniques so that all remote server activity is encrypted.

Secure Shell connects to the server and handles many functions in a control system, such as remote access to the system, secure file transfer, secure command execution and management of network infrastructure components. Its predecessor, Telnet, has fairly weak security, and SSH fixed that problem.

Most data centers have Secure Shell, and it ships with most Linux, Mac and Unix servers. A common use is connecting to an application to build a host system or a remote local machine, in order to make changes, upgrade and access the server automatically.

How the SSH protocol works

The SSH protocol uses a client-server model with a session, made up of several layers and types of encryption, allowing secure authentication between two remote devices. Secure Shell runs on TCP port 22 by default and starts a connection with the client by performing a TCP handshake with the server. Activity on the server after using Secure Shell is encrypted, ensuring a symmetric connection.

Secure Shell works in two basic parts: connection and authentication. Once the two remote devices are connected through the command line “ssh server.example.org”, the protocol compares the user's login details to verify the connection. Authentication in Secure Shell is mainly about hosts supporting each other. It works with terminal emulators, protocol applications and file transfers.

Users can save the host key for the next connection and authentication. It is a hidden file stored by default, so it is very safe from a security standpoint. If you need single sign-on (SSO), the protocol is an ideal choice. You can switch quickly between accounts without re-entering login details.

Encryption techniques in SSH

The main advantage of Secure Shell over earlier applications with similar functions is encryption. Users can transfer data between host and client with confidence.

Symmetric encryption

Symmetric encryption in Secure Shell is a two-way method using a secret key. Anyone who holds the key can decrypt messages for the host and client. It is widely used to encrypt sessions. The generated key must stay secret between the two parties and never be disclosed to a third party.

With symmetric encryption, both computers can share information with each other. Even if a third party intercepts the signal, they cannot decrypt it without the secret key. However, the secret token is limited to one Secure Shell session. If the other side has not received and decrypted the message in that time, a new key must be created to keep the process secure.

Asymmetric encryption

Asymmetric encryption uses two separate keys for encrypting and decrypting. The public key is shared with all parties involved, while the private key is always kept secret. The two keys are closely related and depend on each other, so a message cannot be decrypted by knowing only one of them.

However, asymmetric encryption cannot be applied to every Secure Shell operation. The public-private key pair also has a limited usage time. As soon as decryption succeeds, the Secure Shell session begins.

Hashing

Hashing is also a common encryption method in the Secure Shell protocol. A hash is simple to create from a single input, but the original input cannot be recovered from the hash. Put simply, the client holds the input, and only the client can produce a cryptographic value that lets both sides enter the input. Secure Shell uses hashing to verify messages, so that commands cannot be forged by any method.

Encryption stages of the SSH protocol

There are two basic stages in the SSH protocol's encryption handling: negotiating the encryption standard and authentication. When the client connects over TCP, the server returns the versions it supports. If the client also has a matching Protocol version, an agreement is made and the connection continues. The server uses a key that only the client can use to verify the information correctly.

After the connection is set up, both sides use the Diffie-Hellman key exchange algorithm to create a symmetric key. This algorithm lets the server and client share a key for communication; both sides agree to encrypt and can create a symmetric key for the whole Secure Shell session. Once the encrypted session is established, the protocol moves on to user authentication.

Users are granted access to the Web Server if the protocol can authenticate the information between the two devices. You enter a username and password, which are sent safely through the symmetric secure tunnel. For more safety, though, you should use Secure Shell key pairs, a smart set of keys that can authenticate users without a password.

SSH compared with SSL/TLS and Telnet

The SSH protocol, along with the SSL/TLS protocol and Telnet, all provide authentication between parties. Telnet is one of the earliest Internet protocols, while HTTPS can be seen as the full version of Secure Shell. All three share similar features; see the table below to understand them better.

SSH is highly regarded for security, but some issues remain. For example, keys pile up on the client and need IT staff to manage and clean them out. Data stored in Secure Shell files can also be abused to take over authenticated access. Businesses therefore need stricter storage procedures.

That covers Secure Shell, how it works and its encryption techniques. It is a powerful tool for controlling and managing servers remotely. We hope this article has answered what SSH is and given you the related information.