networks//network protocols//SSH

SSH (**Secure Shell**) is a network protocol that gives an encrypted, authenticated terminal session on a remote machine, along with file copy and port forwarding over the same connection. It is the standard way to administer servers, push to Git hosts and, with a phone client, use a home computer's terminal from anywhere. **OpenSSH** is the common implementation; its server process is **sshd**, listening on TCP port 22.

SSH (Secure Shell) is a network protocol that gives an encrypted, authenticated terminal session on a remote machine, along with file copy and port forwarding over the same connection. It is the standard way to administer servers, push to Git hosts and, with a phone client, use a home computer's terminal from anywhere. OpenSSH is the common implementation; its server process is sshd, listening on TCP port 22.

A connection holds two checks in a fixed order. First the client checks the server: both sides run a key exchange that produces a shared secret and a session identifier, and the server signs that identifier with its host key. The client compares the host key with the one it saved on the first connection (trust on first use); a different key means a different machine is answering. Then the server checks the user, by password or by public key. With a key, the client signs data that includes the session identifier with its private key, and the server verifies the signature against the public keys listed for that user in its authorized_keys file.

A key login proves possession without sending the secret.

The signature covers the session identifier, which is new on every connection, so a captured signature is useless anywhere else (replay attack). A password, by contrast, travels to the server and can be guessed.

The private key can live in hardware that signs but never exports it, such as a phone's secure enclave; the server cannot tell the difference and does not need to.

Once keys work, password login can be switched off (PasswordAuthentication no), which ends guessing attacks outright. An SSH port open to the internet receives automated guesses constantly; behind a VPN it receives none.

On Windows, OpenSSH ships as an optional feature. Accounts in the Administrators group read their keys from C:\ProgramData\ssh\administrators_authorized_keys instead of the user's own file, and sshd ignores that file unless only SYSTEM and Administrators can access it.

The signature algorithms are those of public-key cryptography (Ed25519, ECDSA, RSA); which one a key uses changes nothing in the protocol.