Secure Shell (SSH) is more than just a remote login tool—it's a cornerstone of secure system administration and remote development. In this guide, I will walk you through everything you need to know about SSH, from its internal workings to practical, real-world usage.

What Is SSH and Why Does It Matter?

SSH (Secure Shell) is a cryptographic network protocol for operating network services securely over an unsecured network. The most common applications include remote command-line login, secure file transfers, and tunneling of other protocols.

SSH replaces older protocols such as Telnet and RSH, which transmit data in plaintext, making them highly insecure. With SSH, every command, password, and file is encrypted.

Real-World Analogy

Imagine you're a business owner giving sensitive instructions to an employee over a walkie-talkie in a crowded market. Telnet is like shouting your instructions aloud; SSH is like whispering them in a secret code only your employee understands.

SSH Core Features

1. Encryption

SSH encrypts all data before transmission, protecting against eavesdropping.

# Check SSH version
ssh -V

2. Authentication

SSH supports:

  • Password-based authentication

  • Public key-based authentication (preferred for security)

3. Integrity

Every piece of data sent via SSH is verified using checksums to ensure it hasn't been altered.

4. Port Forwarding (Tunneling)

SSH can forward any TCP connection through an encrypted tunnel, bypassing restrictions such as firewalls.

Installing SSH

Linux 

sudo apt update && sudo apt install openssh-client -y
sudo apt install openssh-server -y
sudo systemctl enable --now ssh

macOS 

ssh -V
# Reinstall if needed
brew install openssh

Windows

Using PowerShell:

Get-Service -Name ssh-agent
Add-WindowsFeature -Name OpenSSH-Client, OpenSSH-Server
Start-Service ssh-agent

Or use tools like PuTTY or Git Bash.

Connecting to a Remote Server

Password Authentication 

ssh user@remote-ip

Public Key Authentication

Generate a key pair:

ssh-keygen -t rsa -b 4096 -C "[email protected]"

Upload your public key:

ssh-copy-id -i ~/.ssh/id_rsa.pub user@remote-ip

How SSH Works Internally

  1. TCP Handshake A standard 3-way handshake initiates the connection.

  2. Protocol Negotiation The client and server exchange protocol versions and supported cryptographic algorithms.

  3. Key Exchange (Diffie-Hellman) Both parties generate a shared secret without directly transmitting it.

  4. Authentication Either via password or public key.

  5. Secure Communication Encrypted commands and responses are transmitted back and forth.

SSH Hardening Best Practices

Edit your SSH configuration:

sudo nano /etc/ssh/sshd_config

Modify the following:

PermitRootLogin no
PasswordAuthentication no
Port 2222

Apply changes:

sudo systemctl restart ssh

Configure your firewall:

sudo ufw allow 2222/tcp
sudo ufw enable

Secure File Transfers with SSH

Using SCP 

scp -P 2222 -i ~/.ssh/id_rsa file.txt user@remote-ip:/destination/

Using Rsync (Recommended) 

rsync -avz -e "ssh -i ~/.ssh/id_rsa -p 2222" file.txt user@remote-ip:/destination/

Why Rsync?

  • Supports resuming transfers

  • Only sends changes

  • Compresses data

  • Preserves file attributes

SSH Tunneling (Port Forwarding)

Local Port Forwarding

Forward remote MySQL (3306) to local port 3307:

ssh -L 3307:127.0.0.1:3306 -N -f -i ~/.ssh/id_rsa -p 2222 user@remote-ip

Connect locally:

mysql -h 127.0.0.1 -P 3307 -u root -p

Remote Port Forwarding

Expose local web server (8080) on remote machine at 9090:

ssh -R 9090:127.0.0.1:8080 -N -f -i ~/.ssh/id_rsa -p 2222 user@remote-ip

Use Cases

  • Bypass geo-blocks

  • Access internal apps securely

  • Replace VPNs

Final Thoughts

SSH is a robust, essential tool for developers, system administrators, and network engineers. By understanding its internals and best practices, you can build more secure, efficient, and reliable systems. Always prefer key-based authentication, disable root login, change default ports, and monitor SSH logs.

Did this guide help? Feel free to comment below or share your SSH tips and war stories.

Written by Mohammad Aman + AI