What is SSH?

Secure Shell (SSH) is a cryptographic network protocol that authenticates and encrypts sessions between a client and a remote host, replacing insecure protocols like Telnet and rlogin. Administrators use SSH for command-line access, remote command execution, and key-based, password-less file transfer over untrusted networks such as the internet.

Key takeaways

• SSH encrypts and authenticates remote command-line and file-transfer sessions.
• Public-key authentication is stronger than passwords and enables automation.
• SSH-2 replaced the insecure, deprecated SSH-1 protocol version.
• Hardening SSH means disabling weak ciphers, ports, and default accounts.
• Versa Director and VOS devices use SSH for administrative CLI access.

On this page: Why it matters · How it works · Types · SSH & Versa · FAQ

Why is SSH important?

Before SSH, administrators reached remote systems with Telnet, rlogin, and rsh – protocols that sent usernames, passwords, and every keystroke in plain text. Anyone observing the network path could capture credentials or hijack a session. SSH replaced all three by encrypting the whole session and verifying the identity of both server and client, which is why it became the default way to manage servers, network devices, and cloud instances.

Its importance persists because remote administration constantly crosses untrusted networks. SSH’s public-key authentication also removed passwords from routine operations, letting scripted logins and configuration-management tools authenticate without a human typing a credential. Nearly every network operating system, Linux distribution, and cloud platform ships an SSH server or client, which makes SSH hygiene – key management, cipher selection, access restriction – a core part of any hardening baseline.

What is SSH?

SSH is built from three cooperating layers. The Transport Layer Protocol establishes the encrypted channel: the client and server negotiate ciphers, exchange a host key so the client can verify it is talking to the genuine server, and derive session keys. The User Authentication Protocol then verifies the client’s identity – by password, by a public/private key pair, or through methods such as keyboard-interactive or host-based authentication. Once authenticated, the Connection Protocol multiplexes the encrypted channel into logical streams: an interactive shell, a single remote command, forwarded TCP ports, or a file-transfer subsystem.

Public-key authentication is preferred: a user generates a key pair, places the public key on the server, and keeps the private key secret. The server challenges the client to prove possession of the matching private key, so no password crosses the network. This same mechanism underlies SFTP and SCP file transfers, which run as subsystems inside an SSH session rather than as separate protocols.

Types of SSH

Two protocol versions exist. SSH-1 has known cryptographic weaknesses and is considered obsolete; virtually all modern deployments use SSH-2, a redesigned and more secure protocol that is the basis of every current implementation, including OpenSSH.

Within SSH-2, several authentication methods coexist: password authentication (simplest, weakest against automated attacks), public-key authentication (the recommended default), keyboard-interactive (challenge-response schemes such as one-time passcodes), and host-based authentication (trusts a client machine rather than a user). The Connection Protocol layer also defines distinct channel types: interactive shell sessions, single remote-command execution, TCP port forwarding (tunneling other traffic through the encrypted session), and the SFTP/SCP subsystems for file transfer. Cipher, MAC, and key-exchange algorithm choice – AES-GCM ciphers, SHA-2 based MACs, curve25519 key exchange – sets the cryptographic strength of a given session.

SSH & Versa

SSH is the primary administrative access path to Versa Director and VOS devices, and Versa Networks treats it as a hardening surface. Devices ship with a default admin SSH user; the SSH Default User feature lets an operator designate a different default user, with its own SSH public key, after which the admin login is disabled.

Manual hardening for branches, controllers, and hubs and manual hardening for Versa Director both dedicate a section to SSH: changing the default port away from 22, disabling the SSH daemon where it isn’t needed, and setting Ciphers, MACs, and KexAlgorithms in sshd_config to modern, approved algorithms. Later VOS releases support an access-list command to restrict SSH, REST, and NETCONF to specific IP addresses, and Director’s UI exposes SSH session controls – Client Alive Interval, Max Concurrent Logins, and Login Grace Time.

Frequently asked questions

What is the difference between SSH-1 and SSH-2?

SSH-1 has known design and cryptographic weaknesses and is obsolete. SSH-2 is a ground-up redesign with stronger algorithms, better integrity checking, and support for multiple authentication methods and channel types. Every current SSH implementation, including OpenSSH, uses SSH-2 exclusively.

What is SSH public-key authentication?

A user generates a public/private key pair, places the public key on the server, and keeps the private key secret. The server issues a cryptographic challenge only the matching private key can answer, so authentication happens without a password ever crossing the network – and it can be automated.

What is SSH port forwarding?

Port forwarding, or tunneling, routes traffic from another application through an already-established, encrypted SSH session. Local forwarding exposes a remote service on the client’s machine; remote forwarding does the reverse. It is commonly used to reach services that aren’t otherwise network-accessible.

What is SFTP and how does it relate to SSH?

SFTP (SSH File Transfer Protocol) is a subsystem that runs inside an authenticated SSH session, giving it the same encryption and key-based authentication as an interactive shell. It replaced older, cleartext transfer protocols such as FTP for secure file transfer.

What SSH cryptographic algorithms should be configured for hardening?

Hardening guidance sets modern values for sshd_config‘s Ciphers, MACs, and KexAlgorithms fields – for example AES-GCM ciphers, SHA-2-based HMACs, and curve25519 key exchange – and removes legacy algorithms that weaker clients might otherwise negotiate down to.

More on SSH

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about SSH, these are worth looking at next.