What Is SSH? The Basics of the Secure Shell Protocol

The command server admins type every single day -- here is what is actually happening behind ssh.

What SSH (Secure Shell) is

SSH is a protocol that encrypts the entire communication channel between a client and a server, so that anyone intercepting the traffic in between cannot make sense of it. It defaults to TCP port 22 and is the standard way to manage Linux and Unix servers, connect to cloud instances, and do remote development work.

Why SSH replaced Telnet

Telnet, the protocol widely used before SSH, sends everything -- including your login username and password -- completely unencrypted. Anyone on the same network segment could capture login credentials and commands just by watching the traffic, which is why SSH was created and why Telnet is essentially never used for remote administration today.

Password authentication vs. public-key authentication

Besides logging in with a username and password, public-key authentication -- keeping a private key only on your own computer and registering just the matching public key on the server -- is the more secure, recommended method. Because only the holder of the private key can decrypt a challenge the server encrypts with the public key, this proves identity without ever transmitting a password, dramatically reducing exposure to brute-force login attacks. Many server administrators disable password login entirely and require public-key authentication only.

What SSH can actually do

SSH is used for far more than running remote shell commands: SCP and SFTP transfer files over the same encrypted connection, port forwarding (tunneling) securely maps a remote port to your local machine, and Git relies on SSH key authentication for accessing remote repositories.

Good habits for managing SSH keys

Always set a separate passphrase on your private key, since a key without one can be used immediately if it is ever leaked. When connecting to a server for the first time and its host key fingerprint looks unfamiliar, do not blindly accept it -- verifying it through a trusted channel is a basic safeguard against being tricked into connecting to an impostor server. Remove any key you no longer use, or suspect may be compromised, from a server's authorized_keys immediately.

The idea behind SSH port forwarding (tunneling)

Say an internal tool, like a database admin panel, is only reachable from inside a private network. Logging into a server that can reach that network over SSH and setting up local port forwarding lets you access the tool as if it were running on your own machine. Because all of that traffic travels through the already-encrypted SSH connection, it is a practical way to securely reach one specific internal service without setting up a full VPN.

What happens the moment you connect for the first time

The very first time you connect to a new server, SSH shows you that server's host key fingerprint and asks you to confirm it before continuing -- this is how SSH defends against a man-in-the-middle attack silently swapping in an impostor server. Once you accept it, that fingerprint is saved locally, so any future mismatch (say, if someone is intercepting your connection) triggers a loud warning instead of connecting silently.

The config file that makes SSH far less tedious

Instead of typing out a long username, hostname, port, and key file every time, a ~/.ssh/config file lets you define a short alias for each server once and just type "ssh myserver" from then on. It is a small setup step that pays off quickly once you are regularly connecting to more than one or two machines.

Frequently Asked Questions

Does changing SSH's default port (22) actually make it more secure?

Changing the port does not fundamentally raise your security level, but it does cut down on automated bots that blindly scan and hammer port 22. It is only a minor, supplementary measure -- disabling password login and requiring public-key authentication matters far more.

Are SSH and a VPN the same thing?

No, they solve different problems. SSH is focused on securely accessing and tunneling to a specific server or service, while a VPN typically routes all (or most) of a device network traffic through an encrypted path -- a much broader scope.