Secure Shell (SSH) Protocol: Encryption Over Insecure Networks

Enterprise Networking Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

Secure Shell (SSH) is a widely used network protocol that enables users to securely access remote servers over unsecured networks. SSH creates a cryptographically secure connection between a server and a client to ensure that subsequent communications are encrypted and have not been tampered with. It is commonly used in various operating systems, such as Linux, Unix, and macOS.

SSH was originally developed in 1995 to replace protocols like Rlogin and Telnet, which came with several security flaws. SSH1 provided users with an encrypted login path to remote systems. It included features like symmetric encryption and enabled port forwarding.

Still, it had numerous security flaws that made it susceptible to cyberattacks. This led to the development of SSH2. The SSH2 protocol, released in 2006 and still in use today, includes additional security measures such as the Diffie–Hellman key exchange and message authentication codes (MACs).

With SSH, users can safely transfer files, manage network infrastructures, remotely access apps and devices, and execute commands. Thanks to its ability to authenticate and encrypt sessions, SSH provides robust protection against cyberattacks and information theft.

How does secure shell protocol work?

The SSH protocol operates on the client/server architecture model within a network. Communication takes place through shells such as Linux terminal shells. Clients use a form of the following command to connect to remote servers:

ssh UserName@SSHserver.example.com

To authenticate and approve the process, SSH uses the Diffie–Hellman key exchange mechanism of public and private keys to access data securely. When a client attempts to connect to a server for the first time, the server will ask the client to prove its identity. The client, in turn, must provide valid credentials to establish its identity. If the client provides incorrect credentials, the authentication is rejected.

The server encrypts a challenge message using the public key and waits for the client to respond. If the client can decrypt the challenge message with the correct private key, it is verified as genuine, and communication between the two is allowed.

It is important to note that the private key is only accessible to the user and should always be kept safe. Exposing the private key can let unauthorized persons access mission-critical systems. Conversely, the public key is used by both the client and the remote server, making it an essential element in the communication process between the two.

SSH tunneling

Let’s say a server wants to access data on your local port that is inaccessible. How do you bypass firewalls and ensure the data is not stolen in transit when it passes through the public internet?

Network tunneling is the process of allowing bi-directional connections between a local port (i.e., the destination port on your own computer) and a remote port via a secure tunnel. SSH tunnels use hashing algorithms and symmetric encryption to encrypt data, thus providing security during data transmission.

To put it simply, SSH tunneling allows you to set up a new connection from your local computer to the remote server through an already-established SSH connection between the client and server. SSH tunneling is preferred by enterprises for its ease of use and its ability to bypass firewalls.

What are the main uses of SSH?

SSH connections are mostly used to:

• Provide a secure way to transfer resources over insecure pathways.
• Ensure secure access to business data and processes.
• Issue remote commands.
• Forward ports.
• Run X11 forwarding.
• Manage operating systems and routers.
• Transfer files between computers.

How secure is SSH?

SSH is generally considered to be one of the most secure encryption methods available today and is currently used on almost half of the world’s servers and nearly every Linux computer.

SSH keys encrypt traffic between the client and server, preventing malicious actors from eavesdropping and decrypting it. However, the proliferation of SSH keys in organizations exposes them to cybercriminals who can take advantage of these unattended and often forgotten SSH keys to gain privileged access to networks. This can result in significant damage to the organization and its stakeholders.

SSH can also be vulnerable to attacks such as brute force attempts to guess passwords or usernames. A significant threat to SSH is hackers exploiting SSH keys to gain root access to the server and install malicious malware. Although unconfirmed, it has been suggested that Edward Snowden successfully exploited SSH keys to breach the National Security Agency (NSA) in 2013.

Implementing multi-factor authentication (MFA), using firewalls, changing default options, deleting untracked/orphan keys, and frequently rotating keys are some ways to secure SSH.

What port is used for secure shell connections?

Port 22 is the default port used for SSH protocol. When an SSH client wishes to connect to an SSH server, it sends a request for communication to the server on port 22. After the connection is made, the server and client exchange cryptographic keys, which are used to create a secure and encrypted communication channel between the two.

Although port 22 is the default port, it is possible for SSH to run on different ports. To change the SSH port number, locate the SSH server configuration file and modify the port number to one of your choice.

How SSH compares to other protocols

SSH vs. Telnet

Telnet is a network protocol that was developed in 1969 and allows users to access remote servers. Over time, SSH has largely replaced Telnet due to its drastically superior security.

• One of the primary differences between Telnet and SSH is that Telnet sends data in plain text form while SSH encrypts the data, making it highly secure.
• SSH uses port 22 by default, but you can change the port number. Telnet uses port 23 and is designed to work with LAN.
• SSH uses public key encryption for authentication purposes. Telnet does not provide any authentication privileges to users.
• SSH is preferred for public networks. In contrast, because of security concerns, Telnet is more suitable for private networks.

SSH vs. SSL and TLS

Similar to SSH, Transport Layer Security (TLS) and Secure Sockets Layer (SSL) are two cryptographic protocols that provide security for data transmitted over the internet. Like SSH, both protocols encrypt data and authenticate the connection. However, SSL has a significant number of security vulnerabilities and has been deprecated. TLS is now widely used as a replacement for SSL due to its improved security features.

While SSH and TLS share some common features, they differ in the following aspects:

Common SSH commands

The ssh command is used to securely log into remote systems. The most basic SSH command is ssh user@host, where “user” is the username/client, and “host” is the address or server of the remote machine.

Some common SSH commands include:

cd command

The cd (change directory) command is used to navigate between directories.

cd [name of the directory]

In case the directory structure is nested, then to reach a particular directory one needs to give the full path of the directory. For example:

cd HomeDirectory/Level1Directory/Level2Directory

The above command then takes you to Level2Directory.

mkdir command

The mkdir (make directory) command is used to create a directory. The syntax for an mkdir command is:

mkdir [folder name]

touch command

The touch command is used for creating a new file. The syntax for the touch command is:

touch [file name]

rm command

The rm (remove) command is used for deleting or removing a file. The syntax for the remove command is:

rm [file name]

cp command

The cp command (copy command) is used for copying a file. The syntax for the copy command is:

cp [source file name] [destination file name]

Bottom line: SSH encryption secures communication over enterprise networks

SSH has successfully replaced older network protocols like rsh, Telnet, and FTP that transferred information in plain text. By using SSH, you can be assured that every single communication between your device and server is secure and encrypted. Therefore, leveraging SSH protocol is an effective approach to protecting network health, particularly in light of continuous cybersecurity threats.

We carefully analyzed and selected the top encryption software to enhance the security of your data in transit and protect your critical communications.