What is SSH and how does it work?
SSH stands for Secure Shell. It is a protocol for logging into a remote computer and running commands on it, over an encrypted connection. If you manage a Linux server, you almost certainly use it already. If you are new to server administration, it is the first thing to understand.
Here is how it actually works.
The basic idea
Before SSH, the standard way to access a remote server was Telnet. Telnet sends everything as plain text. Your username, your password, every command, every response from the server: all of it goes across the network in a format anyone monitoring the traffic can read.
SSH fixes this by encrypting the connection before any data is exchanged. An attacker watching the network traffic sees encrypted bytes. The only meaningful thing they can observe is that a connection happened and how much data was transferred.
What happens when you connect
When you run ssh user@host, a sequence of steps happens before you ever see a prompt:
- Your client contacts the server on port 22 (or whichever port SSH is configured to use).
- Both sides negotiate which encryption algorithms to use. They agree on one that both support.
- They use an algorithm called Diffie-Hellman to establish a shared secret. This is the clever part: both sides can arrive at the same secret key without ever transmitting it, which means an observer cannot learn the key by watching the negotiation.
- All further communication is encrypted with that shared key.
- The server sends its host key, which is a fingerprint that identifies this specific server. Your client checks whether it has seen this fingerprint before. If it has not, it asks you to confirm it. If the fingerprint changed since the last time you connected, SSH warns you, because that is a sign something might be wrong.
- You authenticate. Either by password or by key-based authentication (see below). If authentication succeeds, you get a shell.
Password vs key authentication
Password authentication is what it sounds like. You type a password, the server verifies it against the system's user database.
Key-based authentication is more secure. You generate a key pair: a private key that stays on your machine and a public key that goes on the server in a file called ~/.ssh/authorized_keys. When you connect, the server encrypts a challenge using your public key. Your client decrypts it with the private key and proves it can. The private key never leaves your machine during this process.
Key authentication is also more convenient once it is set up, since you do not need to type a password every time. Our SSH key authentication guide covers the setup.
What SSH gives you beyond a terminal
The encrypted tunnel SSH creates can carry other things besides terminal sessions. Port forwarding lets you route TCP traffic through the tunnel, which is how people access databases and internal web apps that are not publicly exposed. SFTP and SCP use the same connection to transfer files. X11 forwarding lets you run graphical applications remotely.
Most of the time, people use SSH for one thing: a terminal on a remote server. The rest of the capabilities are there if you need them.
Accessing SSH from a browser
If you are on a device without a native SSH client, like a Chromebook or a tablet, SSHDock provides a full SSH terminal that runs entirely in the browser. The encryption happens on your device; the browser connects directly to the server. No install required.
For more on securing the server itself once you can connect, see our guide on 5 ways to lock down your SSH server.