Secure Shell (SSH)

In 1995, a Finnish researcher named Tatu Ylönen witnessed something that would change network security forever. His university network had been compromised through a password-sniffing attack—attackers had captured credentials transmitted in plain text over Telnet connections. Rather than accept this vulnerability as inevitable, Ylönen spent three months developing a solution: the Secure Shell (SSH) protocol.

Today, SSH underpins virtually every secure remote interaction on the internet. Every time a developer pushes code to GitHub, every time a system administrator manages a remote server, every time a cloud deployment pipeline executes—SSH is there, silently encrypting communications, authenticating identities, and protecting the infrastructure that powers our digital world.

Before SSH existed, remote system administration relied on protocols designed in an era when networks were trusted environments. The early ARPANET and academic networks operated on implicit trust—if you could access the network, you were presumed legitimate. This assumption led to protocols that prioritized functionality over security.

The pre-SSH landscape:

The primary tools for remote access in the pre-SSH era were fundamentally insecure by modern standards. Understanding their limitations illuminates why SSH was revolutionary.

The fundamental problem with these protocols:

Every single one transmitted data—including passwords—as plain text across the network. Anyone with access to any network segment between the client and server could capture this traffic using readily available tools. This wasn't a theoretical concern; it was routine practice for attackers.

The attack that sparked SSH's creation:

In 1995, attackers installed packet sniffers on the network at Helsinki University of Technology. These sniffers captured thousands of Telnet sessions, extracting usernames and passwords from the unencrypted traffic. With these credentials, attackers could access any system the compromised users could reach—a cascading compromise that demonstrated the catastrophic weakness of plain-text protocols.

SSH was designed with specific security goals that addressed every weakness of its predecessors. Unlike protocols that added security as an afterthought, SSH integrated cryptographic protection into its fundamental architecture.

The core security objectives:

Defense in depth:

SSH implements multiple layers of protection. Even if one mechanism fails, others continue to provide security:

1. Transport Layer Security: Encrypts all traffic and provides server authentication
2. User Authentication Layer: Verifies client identity through multiple possible methods
3. Connection Layer: Manages multiple logical channels within a single encrypted connection

This layered architecture means an attacker cannot simply exploit one vulnerability to compromise the entire system. Each layer must be independently defeated.

SSH operates as a layered protocol stack, with each layer providing specific functionality. This modular design enables flexibility while maintaining clear separation of concerns.

The three-layer architecture:

Transport Layer Protocol (RFC 4253):

The foundation of SSH security. This layer establishes the encrypted channel:

• Key Exchange: Client and server negotiate shared secrets using algorithms like Diffie-Hellman or Elliptic Curve Diffie-Hellman. These secrets derive session keys without transmitting them over the network.

• Server Authentication: The server proves its identity using a host key. Clients store known host keys to detect impersonation attempts (the basis of the "host key fingerprint" verification).

• Encryption: All subsequent traffic is encrypted using symmetric algorithms (AES-256-GCM, ChaCha20-Poly1305) with keys derived from the key exchange.

• Integrity Protection: Message authentication codes ensure transmitted data cannot be modified without detection.

User Authentication Protocol (RFC 4252):

After the transport layer establishes encryption, the user authentication protocol verifies the client's identity. SSH supports multiple authentication methods:

• Password: Traditional username/password, but transmitted over the encrypted channel
• Public Key: Cryptographic proof of possession of a private key
• Keyboard-Interactive: Challenge-response suitable for multi-factor authentication
• GSSAPI: Integration with enterprise authentication systems like Kerberos

Servers can require multiple authentication methods (e.g., both password AND public key), providing multi-factor security.

Connection Protocol (RFC 4254):

The connection protocol multiplexes multiple logical channels over the single encrypted transport:

• Sessions: Interactive shells or command execution
• Forwarded Channels: Port forwarding and tunneling
• Agent Channels: SSH agent forwarding for key management

Each channel operates independently, with flow control preventing any single channel from monopolizing the connection.

SSH has evolved through major versions, each addressing limitations and security concerns of its predecessors.

SSH-1: The Original Implementation (1995)

Tatu Ylönen released SSH-1 as freeware in July 1995. Within months, it had thousands of users—the security problem it solved was that pressing. SSH-1 introduced the core SSH concepts:

• Encrypted communications replacing Telnet/rsh
• Server host key authentication
• Password and public key user authentication
• Port forwarding capabilities

However, SSH-1 had significant limitations discovered over time:

• Integer overflow vulnerabilities in several implementations
• CRC-32 for integrity, which is not cryptographically strong—leading to the "SSH1 insertion attack"
• No algorithm negotiation—algorithms were hardcoded, making updates difficult
• Commercial licensing as Ylönen founded SSH Communications Security

SSH-2: The Standardized Protocol (2006, Developed from 1996)

The IETF standardized SSH as version 2, addressing SSH-1's weaknesses:

• Modular architecture separating transport, authentication, and connection protocols
• Algorithm negotiation allowing clients and servers to agree on cryptographic methods
• Cryptographic MAC replacing CRC-32 for integrity verification
• Improved key exchange with Diffie-Hellman group exchange
• Cleaner specification enabling independent implementations

SSH-2 is incompatible with SSH-1; they cannot interoperate. Modern systems exclusively use SSH-2.

OpenSSH: The De Facto Standard Implementation

In 1999, the OpenBSD project forked an early SSH implementation to create OpenSSH. Today, OpenSSH is:

• The dominant SSH implementation on Linux, BSD, and macOS
• Included by default in Windows 10 and later
• The reference implementation that drives SSH evolution
• Maintained by the OpenBSD project with a focus on security

OpenSSH continuously evolves SSH-2, adding features like:

• Certificate-based authentication for scalable key management
• Ed25519 keys providing modern elliptic curve cryptography
• FIDO/U2F support for hardware security keys
• Post-quantum key exchange (experimental) anticipating quantum computing threats

Understanding SSH means understanding OpenSSH—its man pages and configuration options define practical SSH usage.

Understanding how SSH establishes a secure connection reveals the protocol's careful security design. Each step builds upon the previous, ensuring security before any sensitive data is exchanged.

Connection establishment phases:

Phase 1: TCP Connection

SSH operates over TCP, defaulting to port 22. The reliable, ordered delivery of TCP is essential—SSH cannot tolerate packet loss or reordering, as cryptographic operations depend on receiving data in sequence.

Phase 2: Protocol Version Exchange

Before cryptographic negotiation, both sides exchange version strings identifying their SSH implementation and version. This allows compatibility detection—servers can support different protocol versions for different clients.

Phase 3: Algorithm Negotiation

Both parties exchange lists of supported algorithms for:

• Key exchange (e.g., curve25519-sha256, diffie-hellman-group16-sha512)
• Host key types (e.g., ssh-ed25519, rsa-sha2-512)
• Encryption (e.g., chacha20-poly1305, aes256-gcm)
• MAC algorithms (e.g., hmac-sha2-512, built into AEAD ciphers)
• Compression (e.g., none, zlib@openssh.com)

The first algorithm from the client's list that the server also supports is selected for each category.

Phase 4: Key Exchange

This critical phase establishes shared encryption keys without ever transmitting them:

1. Both parties generate ephemeral key pairs for the chosen key exchange algorithm
2. They exchange public values
3. Each computes the same shared secret independently using their private values
4. The server proves its identity by signing the exchange hash with its host key
5. Both derive session keys from the shared secret

This is where forward secrecy comes from—the ephemeral keys are discarded after deriving session keys. Even if the server's host key is later compromised, captured traffic cannot be decrypted because the ephemeral keys no longer exist.

Phase 5: Encryption Activation

The NEWKEYS message signals that all subsequent traffic uses the negotiated encryption and MAC algorithms with the derived session keys. From this point, all communication is encrypted.

Phase 6: User Authentication

Now within the encrypted channel, the client authenticates. This might involve:

• Sending a password (encrypted, unlike Telnet)
• Proving private key possession through cryptographic signatures
• Responding to challenges for keyboard-interactive authentication
• Presenting certificates validated against a trusted CA

Phase 7: Session Establishment

After successful authentication, the client requests channel(s) for interactive sessions, command execution, port forwarding, or file transfer. Multiple channels share the single encrypted connection.

SSH's versatility extends far beyond interactive shell access. Its secure transport and flexible architecture support numerous critical functions in modern infrastructure.

SSH's security derives from cryptographic primitives and careful protocol design. Understanding this model helps appreciate both SSH's strengths and its requirements for proper configuration.

The cryptographic foundation:

SSH security rests on established cryptographic primitives:

1. Key Exchange: Elliptic Curve Diffie-Hellman (curve25519) or traditional Diffie-Hellman with large primes establishes shared secrets without transmitting them.

2. Encryption: Modern SSH uses authenticated encryption (AES-GCM, ChaCha20-Poly1305) providing both confidentiality and integrity in a single operation.

3. Digital Signatures: Ed25519, RSA-SHA256, or ECDSA signatures prove identity without revealing private keys.

4. Key Derivation: HMAC-based KDF derives multiple session keys from the shared secret and session identifier.

The importance of algorithm selection:

SSH supports negotiable algorithms to enable evolution as cryptographic understanding advances. However, this flexibility requires attention:

• Preferred algorithms: Ed25519 keys, curve25519 key exchange, ChaCha20-Poly1305 or AES-256-GCM encryption
• Acceptable algorithms: RSA keys ≥3072 bits with SHA-256, DH group 16+, AES-128-CTR with HMAC-SHA-256
• Deprecated algorithms: DSA keys, DH groups ≤14, MD5 or SHA-1 based MACs, arcfour/blowfish

We've covered the foundational concepts of SSH—from its origins as a response to network security failures to its architecture as a layered cryptographic protocol. Let's consolidate the essential takeaways:

What's next:

With this conceptual foundation, we'll explore the SSH protocol in detail. The next page examines the specific protocol mechanisms—packet formats, message types, and the precise sequence of operations that implement SSH's security guarantees.