Data transmission between devices on a network must be properly secured against eavesdropping, tampering, and unauthorized access. This security is provided by network protocols that define how data is transmitted and protected. SSH (Secure Shell) was created because earlier remote access protocols, specifically Telnet and rsh (remote shell), transmitted all data including usernames, passwords, and commands in plaintext, leaving them exposed to anyone with network monitoring access. The need for a secure alternative led to the creation of the SSH protocol. SSH matters because it is the standard mechanism for remote server access across the internet and enterprise networks, and SSH keys are the cryptographic mechanism that makes that access secure. The recommended action: enable SSH key-based authentication on all servers, disable password-based SSH authentication, and manage the SSH key lifecycle systematically. For the operational management guide, see the sister blog A Guide to Protect and Manage SSH Keys to Mitigate Security Risks. For enterprise SSH key management, see SSH Secure.
Quick Answer: How Do SSH Keys Work?
SSH (Secure Shell) keys are a public/private key pair used in the SSH Authentication layer to prove identity without transmitting a password. When a client initiates an SSH connection, the server issues a cryptographic challenge encrypted with the client’s public key (which is stored in the server’s authorized_keys file). Only the holder of the corresponding private key can decrypt the challenge and respond correctly. If the response is valid, authentication succeeds and the session proceeds through the encrypted channel established by the SSH Transport layer. The private key never leaves the client system; it is never transmitted to the server. This is the fundamental security property that makes SSH key authentication resistant to network interception and credential stuffing attacks.
What Is SSH?
Secure Shell (SSH) is the network protocol that provides a secure way for two devices, such as computers or servers, to connect remotely over an unsecured network. SSH employs encryption to ensure that attackers who intercept the network traffic between two connected devices cannot read or modify the communication. SSH consists of three distinct protocol layers, each with a specific role in establishing and maintaining a secure connection.
Transport Layer
The Transport Layer is the first layer and establishes the encrypted channel between client and server before any authentication occurs. It performs cryptographic negotiation (agreeing on which encryption algorithms, hash functions, and key exchange methods to use), conducts the initial key exchange that establishes the session encryption keys, and then provides encryption, decryption, and integrity protection for all subsequent communication. It also handles data compression to improve data exchange speed. The Transport Layer ensures that all authentication data transmitted in the next layer is protected from eavesdropping.
Authentication Layer
The Authentication Layer runs on top of the encrypted Transport Layer and communicates the supported authentication methods to the client. It then conducts the user authentication process. Common authentication methods include public-key (SSH key-based), password, and host-based authentication. SSH key authentication works at this layer: the server challenges the client to prove possession of the private key corresponding to a public key that the server has authorized. The challenge-response exchange proves identity without the private key ever being transmitted.
Connection Layer
The Connection Layer runs after authentication succeeds and manages all communication between the devices. It handles the opening and closing of communication channels and supports multiplexing: running multiple logical channels (such as an interactive terminal session, a file transfer, and a port forward) simultaneously over a single TCP connection. This efficiency means SSH can support complex workflows without requiring multiple separate connections.
What Is SSH Used For?
SSH provides a secure encrypted channel for a wide range of data exchange and access scenarios between machines or devices. The five primary use cases are:
-
Remote Access
SSH ensures encrypted remote connections for both users and automated processes to access servers, network devices, and cloud infrastructure. It is the standard mechanism for system administration of Linux and UNIX-based systems. All commands typed in the terminal and all output displayed are encrypted in transit.
-
File Transfer (SFTP)
SFTP (SSH File Transfer Protocol) is a secure file transfer protocol managed by SSH. It provides a secure way to upload, download, and manipulate files over a network, replacing FTP which transmits file content and credentials in plaintext. SFTP is supported by all major SSH implementations.
-
X11 Forwarding
Users can run graphical applications hosted on a remote server and display the application interface on their local client machine, using SSH as the encrypted transport for the graphical protocol (X Window System). This enables remote use of graphical tools on servers that support X11.
-
Port Forwarding
After mapping a client’s local port to the server’s remote ports, SSH helps secure other network protocols like TCP/IP that are not natively encrypted. Applications that connect to the local port have their traffic automatically tunneled through the encrypted SSH connection to the remote destination.
-
Tunneling
SSH tunneling is an encapsulation technique that creates an encrypted passage for data transfers. It is useful for accessing business-sensitive resources from unsecured networks such as public Wi-Fi, and for encapsulating protocols that would otherwise be exposed to network eavesdropping.
How Does SSH Work?
The mechanics of initiating an SSH connection differ slightly by operating system. On Linux and Mac, SSH is built into the operating system and available directly from the terminal. For Windows users, a dedicated SSH client is required; the most common is PuTTY, though Windows 10 and later also include a built-in OpenSSH client accessible from PowerShell or Command Prompt.
On Linux and Mac, a user opens the terminal and enters the SSH command in the following format:
ssh {user}@{host}
This command has three components. ssh instructs the system to open an encrypted Secure Shell connection using the SSH protocol. {user} specifies the account the user wants to access on the remote system; for example, a user might specify the root account (the system administrator account with complete access rights) or a named user account. {host} specifies the computer to connect to, either as an IP address or a domain name.
After the user hits enter, the SSH client contacts the SSH server on the remote system. The SSH Transport layer negotiates the encrypted channel. If the server requires password authentication, the user is prompted to enter the password for the requested account; if using SSH key authentication, the challenge-response process occurs automatically. Once authentication succeeds, the user is presented with a remote terminal window from which they can execute commands on the remote system.
The remote server is designated a TCP port through which it monitors the network and waits for clients to initialize a connection. SSH uses TCP port 22 by default. The server listens on this port continuously, accepting connection requests from clients that pass the authentication process. Organizations can restrict which source IP addresses are permitted to reach port 22 through firewall rules, significantly reducing the attack surface for automated scanning and brute force attacks.
SSH vs Earlier Protocols: Why Telnet and rsh Were Replaced
| Characteristic | Telnet | rsh (Remote Shell) | SSH |
|---|---|---|---|
| Authentication encryption | None: credentials in plaintext | None: host-based trust only | Full: encrypted challenge-response |
| Data encryption | None: all commands and output in plaintext | None | Full: AES, ChaCha20, or other negotiated cipher |
| Integrity protection | None | None | HMAC-based message authentication |
| Resistance to network eavesdropping | None | None | Complete: encrypted traffic is unreadable without the session key |
| Current status | Deprecated for remote access; used only in isolated legacy contexts | Deprecated; replaced by SSH | Current standard for secure remote access |
Conclusion
SSH is useful in diverse situations and is secure, efficient, and lightweight, making it the standard for remote server access across the internet and enterprise infrastructure. SSH communication is encrypted using negotiated algorithms and cannot be interpreted by unauthorized systems monitoring the network. The three-layer architecture (Transport, Authentication, Connection) provides a well-structured approach to establishing secure, authenticated, multi-channel communications. For guidance on managing SSH keys securely in enterprise environments, see A Guide to Protect and Manage SSH Keys and SSH Secure.
Frequently Asked Questions
What is SSH and why was it created?
Secure Shell (SSH) is a cryptographic network protocol providing encrypted remote access between devices. It was created because Telnet and rsh transmitted all data including passwords in plaintext, leaving them vulnerable to network eavesdropping. SSH replaced them by using encryption to protect all communication, making intercepted traffic unreadable.
What are the three layers of the SSH protocol?
The three layers are: (1) Transport Layer, which establishes the encrypted channel through key exchange and negotiation; (2) Authentication Layer, which conducts user authentication via password, public key, or host-based methods; and (3) Connection Layer, which manages multiple logical channels (terminal sessions, file transfers, port forwards) over the single TCP connection after authentication succeeds.
What are the five primary use cases for SSH?
The five primary uses are: (1) Remote Access for encrypted server administration; (2) File Transfer via SFTP for secure file manipulation; (3) X11 Forwarding for remote graphical application display; (4) Port Forwarding to tunnel unencrypted protocols through SSH; and (5) Tunneling for encrypted access to resources over unsecured networks.
What is the difference between SSH keys and SSH passwords for authentication?
Password authentication transmits the password (encrypted) to the server and is vulnerable to brute force and credential stuffing. SSH key authentication uses a cryptographic challenge-response: the private key never leaves the client and is never transmitted to the server, making it immune to password attacks. SSH keys are recommended for all server environments, with password authentication disabled on the SSH server.
What port does SSH use and why does it matter for security?
SSH uses TCP port 22 by default. Because port 22 is well-known, it is targeted by automated scanners and brute force attacks. Restricting SSH access to specific source IP ranges through firewall rules, and using a VPN or bastion host for remote access, significantly reduces the attack surface. Rate limiting on the SSH port slows brute force attempts.
