Secure Shell Protocol (SSH)

SSH is a cryptographic network protocol used to securely access and manage remote computers over an unsecured network. It is commonly used for remote server administration, file transfer, and secure tunneling.

Core idea

SSH creates a secure communication channel between a client and a server by providing:

• Encryption: Prevents attackers from reading transmitted data (e.g., passwords, commands, files)
• Authentication: Verifies the identity of the server and optionally the client
• Integrity: Ensures that transmitted data is not modified during communication

The primary application is to allow users to securely execute commands on remote machines as if they were directly connected to the system.

Common SSH applications include:

• Remote shell access:

  ssh -p [PORT] [USERNAME]@[SSH-SERVER-IP]

• Secure file transfer: SCP (Secure Copy Protocol), SFTP (SSH File Transfer Protocol)
• Port forwarding, tunneling: Securely forwarding network traffic through an SSH connection

ssh -L [LOCAL-PORT]:[DESTINATION-HOST]:[DESTINATION-PORT] [USERNAME]@[SSH-SERVER-IP]

SSH Connection Process

SSH authentication is the process where a client verifies the identity of a server and establishes an encrypted communication channel before sending commands or data.

The SSH connection consists of three main phases:

1. Transport Layer Establishment

   • Negotiates encryption algorithms
   • Performs server authentication
   • Establishes a shared secret key

2. User Authentication

   • Verifies the identity of the client user

3. Session Establishment

   • Creates an interactive shell or data transfer session

Client                                      Server
  │                                           │
  │─── 1. TCP Connection (Port 22) ───►│
  │                                           │
  │◄── 2. Protocol Version Exchange  ───│
  │                                           │
  │─── 3. Algorithm Negotiation ────► │
  │     (encryption, key exchange methods)    │
  │                                           │
  │◄───  4. Server Host Key ───────│
  │          (server public key)              │
  │                                           │
  │───── 5. Key Exchange ───────►│
  │      (generate shared session key)        │
  │                                           │
  │══ Encrypted Channel Established ════│
  │                                           │
  │──── 6. User Authentication  ────►│
  │         (password / public key)           │
  │                                           │
  │◄─── 7. Authentication Success ────│
  │                                           │
  │─ 8. Execute Commands / Transfer Data ─►│

1. TCP Connection

SSH runs on top of TCP and usually uses port 22.

The client first establishes a TCP connection:

ssh user@example.com

2. Protocol Version Exchange

The client and server exchange SSH protocol versions.

Example:

Client:
SSH-2.0-OpenSSH_9.6

Server:
SSH-2.0-OpenSSH_9.6

This ensures both sides support a compatible SSH protocol version.

3. Algorithm Negotiation

The client and the server exchange their lists of supported algorithms and then negotiate a set that both sides support. including:

• Key exchange algorithm
  • Determines how a shared secret is generated
  • Example:
    • Diffie-Hellman
    • Elliptic Curve Diffie-Hellman (ECDH)
• Encryption algorithm
  • Used for encrypting communication
  • Example:
    • AES
    • ChaCha20
• Message authentication algorithm
  • Ensures data integrity
  • Example:
    • HMAC-SHA2

SSH Server Authentication

Unlike HTTPS, SSH does not use a Certificate Authority (CA) by default. Instead, SSH uses a host key to verify the identity of the server.

Host Key Concept

The SSH server owns a permanent public/private key pair:

Server:

Private Key
     |
     |
     +----> Public Key (Host Key)

The public key is stored on the client:

~/.ssh/known_hosts

Example:

github.com ssh-ed25519 AAAAC3...

First Connection

When the client connecting to a new server:

ssh user@server.com

The server sends its public host key:

Server
   |
   |---- Public Host Key ---->
   ↓
Client

If the user allows for establishing new connection to the remote via SSH:

Server Public Key
        |
        ↓
~/.ssh/known_hosts

The key is saved on the client for future verification.

Future Connections

On later connections:

Client                          Server

  │                               │
  │──  Request Connection ──►│
  │                               │
  │◄── Server Host Key ────│
  │                               │
  │  Compare with known_hosts     │
  │                               │
  │   Match → trusted server     │

If the key changes:

WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED

This may indicate:

• Server reinstallation
• Legitimate key rotation
• Man-in-the-middle attack

SSH Key Exchange

SSH uses asymmetric cryptography only during authentication and key exchange. The goal is to create a shared symmetric encryption key to establish the transmission channel, and derive session key.

Example using Diffie-Hellman:

Client                              Server

Private Secret A                    Private Secret B
       │                                  │
       │                                  │
       ▼                                  ▼

Public Value A  ─────────►  Public Value B


Both compute:
Shared Secret Key

The shared key is never transmitted over the network. After this, all communication uses symmetric encryption.

User Authentication

After establishing a secure channel, SSH authenticates the user. Common methods:

1. Password Authentication

User sends:

Username + Password

through the encrypted SSH channel.

Example:

ssh username@server

2. Public Key Authentication (Recommended)

The user generates a key pair:

ssh-keygen

Result:

Private key:
~/.ssh/id_ed25519

Public key:
~/.ssh/id_ed25519.pub

The public key is copied to the server:

ssh-copy-id username@server

Server stores:

~/.ssh/authorized_keys

Authentication process:

Client                              Server

Private Key
    |
    |
Sign challenge
    |
    |─── Signature ────────►
                                      |
                                 Verify using
                                  Public Key
                                      |
                              Authentication OK

The private key never leaves the client.

SSH vs TLS

Feature	SSH	TLS
Main usage	Remote login	Secure web communication
Common port	22	443
Authentication	Host key + user authentication	Certificate-based
Certificate Authority	Usually not required	Required
Encryption	After handshake	After TLS handshake
Example	ssh user@server	HTTPS

SSH Key Management

Generate SSH Key Pair

ssh-keygen -t ed25519

Creates:

~/.ssh/id_ed25519
~/.ssh/id_ed25519.pub

Copy Public Key to Server

ssh-copy-id user@server

Equivalent to adding:

client_public_key

into:

~/.ssh/authorized_keys

SSH Configuration

Users can define shortcuts:

File:

~/.ssh/config

Example:

Host myserver
    HostName 140.xxx.xxx.xxx
    User ubuntu
    IdentityFile ~/.ssh/id_ed25519

Then:

ssh myserver

instead of:

ssh ubuntu@140.xxx.xxx.xxx

SSH Port Forwarding (Tunneling)

SSH can forward network traffic through an encrypted connection.

Local Port Forwarding

Example:

Client                     Server

  │                         │
  │    localhost:8080       │
  │                         │
  │====== SSH Tunnel =======│
                             │
                       localhost:80

Command:

ssh -L 8080:localhost:80 user@server

Useful for:

• Accessing internal services
• Database connections
• Securely accessing private networks