How SSH Works: Secure Connection to Remote Servers

SSH (Secure Shell) is a protocol that enables secure connection to a remote computer over an unsecured network. Every system administrator, developer, or anyone managing a server uses SSH daily. Without SSH, remote access to servers would be exposed to eavesdropping and attacks.

What is SSH?

SSH is a cryptographic network protocol that operates over TCP/IP networks. It was developed in 1995 as a replacement for older, insecure protocols like Telnet and rlogin, which transmitted data in plain text - including passwords. SSH uses encryption to protect all communication between client and server.

The default port for SSH is 22.

Key Concepts

Client: The computer you are connecting from (e.g., your PC)
Server: The remote computer you are connecting to (e.g., a VPS)
Key pair: Public and private key for authentication
known_hosts: A file storing fingerprints of servers you have connected to
authorized_keys: A file on the server containing public keys of users allowed to connect

Connection Process

When you type ssh user@server in the terminal, the following steps occur:

Step	Description
1. TCP connection	The client establishes a TCP connection to the server on port 22
2. Version negotiation	Both sides exchange supported SSH versions and encryption algorithms
3. Key exchange	Diffie-Hellman algorithm is used to securely exchange a shared secret key
4. Server authentication	The client verifies the server's identity (fingerprint / known_hosts)
5. User authentication	The user authenticates with a password or private key
6. Encrypted session	All subsequent communication is encrypted with symmetric encryption

Password or Key Authentication?

SSH supports two main authentication methods. Using keys is recommended because it is more secure and practical:

Feature	Password Authentication	Key Authentication
Security	Lower (vulnerable to brute-force attacks)	High (nearly impossible to guess)
Convenience	Entering password each time	No password, automatic connection
Automation	Unsuitable for scripts	Ideal for scripts and CI/CD

Generating a Key Pair

Creating SSH keys is straightforward. On Linux or macOS, open a terminal and run:

# Generate an ED25519 key (recommended, modern and fast)
ssh-keygen -t ed25519 -C "your-email@example.com"

# Generate an RSA key (alternative, if the server does not support ED25519)
ssh-keygen -t rsa -b 4096 -C "your-email@example.com"

# After generation, copy the public key to the server
ssh-copy-id user@server-ip

After running ssh-keygen, you will get two files:

~/.ssh/id_ed25519 — private key (never share this with anyone!)
~/.ssh/id_ed25519.pub — public key (this goes on the server in ~/.ssh/authorized_keys)

Basic Commands

Here is an overview of the most commonly used SSH commands:

Command	Description	Example
ssh	Connect to a remote server	ssh user@192.168.1.10
ssh -p	Connect on a non-standard port	ssh -p 2222 user@192.168.1.10
ssh-keygen	Generate a key pair	ssh-keygen -t ed25519
ssh-copy-id	Copy public key to server	ssh-copy-id user@192.168.1.10
scp	Securely transfer files over SSH	scp file.txt user@192.168.1.10:/path/
rsync -e ssh	Synchronize files over SSH	rsync -avz -e ssh ./local/ user@server:/remote/

SSH Configuration File

If you frequently connect to multiple servers, manually typing IP addresses and ports is tedious. SSH allows a configuration file ~/.ssh/config where you can define aliases:

# ~/.ssh/config

Host my-server
    HostName 192.168.1.10
    User user
    Port 22
    IdentityFile ~/.ssh/id_ed25519

Host production
    HostName production.vadnica.org
    User deploy
    Port 2222
    IdentityFile ~/.ssh/deploy_key

With these settings, instead of a long command, you simply connect with:

ssh my-server

Port Forwarding

SSH can also be used to securely access services that are not directly reachable from the internet. For example: you have a database on a server that listens only on localhost and you want to access it securely from your own computer:

# Local forwarding
# Access a remote database on local port 5432
ssh -L 5432:localhost:5432 user@server

# Now connecting to localhost:5432 reaches the database
# that is actually running on the remote server

# Remote forwarding
# Allow access to a local service from the server
ssh -R 8080:localhost:3000 user@server

Security Recommendations

If you have your own server, these are the most important SSH security measures:

Disable password authentication: Use keys only. In the file /etc/ssh/sshd_config set PasswordAuthentication no
Disable root login: Set PermitRootLogin no. Log in as a regular user and use sudo
Change the default port: Instead of port 22, use e.g., 2222. This reduces automated attacks
Use fail2ban: A tool that automatically blocks IP addresses after multiple failed login attempts
Keep OpenSSH updated: Older versions have known security vulnerabilities

IMPORTANT: Before editing /etc/ssh/sshd_config, make a backup of the file! If you make a mistake, you may not be able to connect to the server anymore.

Why Use SSH?

SSH is a fundamental tool for anyone working with remote systems. Whether you manage a VPS, configure Docker containers on a server, securely transfer files, or establish a secure tunnel to private services - SSH is the tool you need.

Unlike Telnet or FTP, which transmit data in plain text, SSH ensures that all your passwords, commands, and files are encrypted and protected from eavesdropping. In today's world, where attacks on online services are commonplace, using SSH is not a choice - it is a necessity.