Abu Zar Mishwani
Secure Shell or Secure Socket Shell, commonly known as SSH, is a powerful tool used to securely access remote systems. Whether you’re a system administrator, developer, or power user, SSH can be a valuable asset to your toolkit.
In this article, we’ll explore the basics of SSH and how it can be used to improve security and productivity.
Table of Contents
SSH (Secure Shell) is a protocol used to securely log onto remote systems. It provides a secure channel over an unsecured network in a client-server architecture, connecting an SSH client application with an SSH server. SSH is widely used by network administrators to securely access systems remotely, as well as to securely transfer files between computers. It is also used by developers to access remote repositories and collaborate on projects.
SSH uses public-key cryptography to authenticate the remote computer and allow the remote computer to authenticate the user, if necessary. It also provides encrypted data communication between two computers connecting over an unsecured network, such as the Internet.
For example, a user might use SSH to securely connect to a remote server to access a web application. The SSH client authenticates the user and then creates a secure connection between the client and the server. The user can then securely transfer files between the two computers, as well as securely execute commands on the server.
SSH can be also utilized to establish secure tunnels for different application protocols, for instance, to securely access graphical sessions remotely through the X Window System. By default, the SSH server is configured to listen on the standard TCP port 22.
How Does SSH Work?
Secure Shell (SSH) is a network protocol that provides a secure connection between two computers over an unsecured network. It is commonly used for remote server administration, secure file transfer, and secure tunneling. SSH works by establishing a secure connection between the two computers using public-key cryptography.
To establish an SSH connection, the client computer first authenticates itself to the server using the user’s public-key pair. The user’s public key is stored on the server, and the user’s private key is held by the client’s computer. The server then sends back an encrypted challenge that must be decrypted using the client’s private key. If the decryption is successful, the server knows that the user is who they claim to be.
Once the authentication is successful, the server and client negotiate a secure tunnel between them. This tunnel is encrypted using symmetric algorithms such as AES or 3DES. All data sent over the tunnel is encrypted and decrypted by the server and client computers.
To establish an SSH connection from the command line, the ssh command is used. The general syntax for this command is:
ssh [username]@[host]This command will connect to the server specified by [host] using the username specified by [username].
The user will be given the remote host’s public key fingerprint and asked to connect if this is the first time the local host and server are negotiating a connection, even if there hasn’t been any prior connection:
The authenticity of host 'sample.ssh.com' cannot be established. DSA key fingerprint is 01:23:45:67:89:ab:cd:ef:ff:fe:dc:ba:98:76:54:32:10. Are you sure you want to continue connecting (yes/no)?By responding ‘yes’ to the prompt, the session will continue, and the host key will be recorded in the known_hosts file, which is typically located in the hidden directory /.ssh/known_hosts in the home directory of the user.
Once connected, the user can run commands on the remote computer or transfer files using the scp command. The general syntax for this command is:
scp [source_file] [username]@[host]:[destination_file]This command will copy the file specified by [source_file] from the local computer to the remote computer specified by [host]. The file will be stored as [destination_file] on the remote computer.
The user can then exit the SSH session by typing exit or logout at the command prompt. This will close the SSH connection and terminate the session.
What is SSH Used For?
SSH is a standard feature on any Unix, Linux, or Mac server and is present in all data centers. It creates a secure connection between a local computer and a remote host, enabling remote access to resources, command execution, software patching and upgrades, and different administrative tasks.
Making a secure connection between two computers, far and near, is the primary aim of SSH. Additionally, it is utilized for the remote administration of routers, server hardware, virtualization platforms, and OSes and for the purpose of inside systems management and file transfer.
A Secure Shell connection enables users to connect to remote servers, modify files, upload files, and end the session via the command line or another tool. SSH keys can be utilized to facilitate automatic access to servers and are frequently used in programs such as scripts, backup systems, and configuration management tools.
SSH keys are intended for practicality and to be used across different organizations, allowing for single sign-on (SSO) so that users don’t have to enter a password every time they switch accounts.
SSH is not only used for identity and access management but also provides users with a secure connection, as all data is encrypted during transmission. It allows users to securely send files, browse the web, and execute commands without compromising their privacy.
Capabilities of SSH
The primary capabilities of SSH are:
1. Encryption: SSH uses strong encryption protocols to protect data transferred over the network. Data is encrypted and decrypted using a public key and a private key. The private key is kept on the client system and is used to encrypt and decrypt data sent over the network.
2. Authentication: SSH uses various authentication methods to verify the user’s identity. The most common authentication methods are password authentication and public key authentication.
3. Port Forwarding: SSH provides a way to forward ports from one system to another securely. This is useful for establishing secure connections to systems that are behind a firewall or NAT device.
4. Tunneling: SSH can be used to establish secure tunnels between two computers. This is useful for securely accessing internal systems, such as databases, that are not exposed to the public internet.
5. Remote Execution: SSH can be used to execute commands on remote systems. This is useful for running automated scripts or for managing remote systems.
6. File Transfer: SSH can be used to transfer files between two computers securely. This is useful for securely transferring sensitive data between systems.
SSH Encryption Techniques
SSH uses three distinct encryption methods in various stages during the transmission process to ensure security while exchanging data. These techniques are:
- Symmetrical Encryption
- Asymmetrical Encryption
- Hashing
Symmetrical Encryption
Symmetrical encryption, also known as secret key encryption, is a type of encryption algorithm where the same key is used to encrypt and decrypt data. It is a type of encryption technique used in SSH (Secure Shell) to provide secure communication between two computers over an unsecured network.
In symmetrical encryption, data is encrypted with a single secret key and can only be decrypted using the same key. This means that the key must remain secure and be shared between the two parties communicating in order to decrypt the data. The key is usually exchanged over a secure channel, and any eavesdroppers will not be able to decrypt the data unless they have the key.
SSH encrypts data using a symmetrical encryption algorithm such as AES (Advanced Encryption Standard). This ensures that any data sent over the network is secure and cannot be read by anyone other than the intended recipient.
To further enhance the security of SSH, a two-factor authentication system is used. This system requires a user to provide two pieces of information, such as a username and password, in order to log in. The two factors are then encrypted using a symmetrical encryption algorithm, which ensures that only the intended user can access the system.
Different symmetrical encryption ciphers used by this encryption technique include Data Encryption Standard (DES), Triple DES (3DES), Blowfish, Twofish, and Advanced Encryption Standard (AES).
DES is an old but still widely used encryption algorithm that uses a 56-bit key length. 3DES is an improvement on DES that increases the key length to 168 bits. Blowfish and Twofish are more modern algorithms that are both considered to be more secure than DES and 3DES.
AES is the most commonly used symmetrical encryption cipher and is the US government standard for secure data encryption. It uses a 128, 192, or 256-bit key length and is considered to be one of the most secure algorithms available.
For example, if Ali wants to send a secure message to Imad, they can use symmetrical encryption. Ali and Imad will both agree on a secret key and use it to encrypt and decrypt the message. As long as the key is kept secret, only Ali and Imad will be able to access the message.
Asymmetric Encryption
Asymmetric encryption is an encryption technique that uses two related keys, a public key and a private key, to encrypt and decrypt data. The public key is available to everyone, while the private key is only known to the recipient. This technique is also known as public-key cryptography.
Contrary to popular belief, asymmetric encryption is not applied to secure an entire SSH session. Instead, it is used to establish a secure connection via symmetric encryption. Both sides in the connection generate temporary public-private key pairs and exchange their private keys to create the shared secret key.
When using SSH, the user establishes a secure connection with the remote computer via an SSH server. The server authenticates the user using a public key and then encrypts the data using a symmetric key. The symmetric key is then encrypted using the user’s public key so that only the user’s private key can decrypt it. This ensures that the data is only readable by the user and not anyone else on the network. The symmetric key is then used to encrypt the data that is sent back and forth between the user and the server.
The main advantage of asymmetric encryption is that it eliminates the need for a shared secret key. Instead, the public and private keys are used for authentication and encryption. This eliminates the need for both parties to share a secret key, making it much more secure.
One of the most widely used asymmetric encryption algorithms is RSA (Rivest–Shamir–Adleman). This algorithm consists of two related keys, the public and private keys. The public key is used to encrypt data, and the private key is used to decrypt data. A message encrypted with the public key can only be decrypted with the private key and vice versa.
Other symmetric encryption ciphers used with asymmetric encryption include Diffie-Hellman, ElGamal, Elliptic Curve Cryptography, and Digital Signature Algorithm.
Hashing
Hashing is an encryption technique used to create one-way encryption of data. It works by taking a plain-text input and running it through a mathematical algorithm, which produces a unique, fixed-size output known as a “hash” or a “hash value.” This hash value can be used to identify the original data, and any changes to the data will produce a different hash value.
SSH utilizes hash algorithms to check the validity of messages by using Hash-based Message Authentication Codes (HMACs). This is done to ensure that the instructions received have not been modified in any way.
A MAC (Message Authentication Code) must accompany each transmission in order to utilize this security measure. This MAC comprises a symmetric key, a packet sequence number, and the content of the message; together, these three components are then used to form a hash function, producing a meaningless string sent to the host. On the receiving end, the host replicates the same parameters to generate their own hash, and if this hash matches the one sent, it proves that the message has not been tampered with.
The Architecture of SSH Protocol
Three separate layers make up the SSH architecture. These layers include:
- Transport Layer
- User-authentication Layer
- Connection Layer
The SSH protocol architecture has a wide range of applications due to its open architecture, which allows it to be utilized for more than just a secure shell. The transport layer is like the technology used for TLS. The user-authentication layer is configurable and allows for the use of diverse authentication methods. The connection layer enables multiple secondary sessions to be combined into one SSH connection.
Transport Layer
The transport layer is the highest level of the TCP/IP protocol suite. The Transport Layer of the SSH protocol is responsible for providing secure, reliable end-to-end communication between two hosts. It uses a variety of cryptographic techniques and protocols to ensure the confidentiality and integrity of the data transmitted. It also provides authentication, key exchange, and session establishment. It is responsible for encrypting data sent over the network and validating the authenticity of the received data.
The Transport Layer also provides flow control and congestion control. It serves as a gateway for transferring and obtaining plain-text packets of a maximum of 32,768 bytes. It is also responsible for negotiating the encryption algorithms and exchange algorithms and setting up and managing the connection.
User Authentication Layer
The User Authentication Layer is the second layer of the SSH Protocol architecture. It is responsible for verifying the user’s identity connecting to the server. It is done by using public-key cryptography and a challenge-response protocol.
The various authentication methods include password-based authentication, public-key authentication, host-based authentication, and Kerberos authentication.
- Password-based authentication is the most common form of authentication used in SSH protocols. It involves a user entering a username and password combination to gain access to the server.
- Public-key authentication is a more secure method of authentication. It involves a user having a public/private key pair. The public key is stored on the server, while the private key is stored on the user’s computer. When the user attempts to connect to the server, the server sends a challenge to the user, and the user must respond by signing it with their private key.
- A host-based authentication is a form of authentication that uses the host’s identity to verify the user’s identity. This is done by comparing the user’s credentials against the host’s credentials.
- Kerberos authentication is a form of authentication that uses a centralized authentication server to verify the user’s identity. This is done by the user providing their credentials to the authentication server, which then verifies the user’s identity against a database of users.
Connection Layer
The Connection Layer is the third layer of the SSH protocol architecture. This layer is responsible for setting up and managing the secure SSH session between the client and server. It does this by providing authentication, encryption, and integrity protection for the session. The Connection Layer also handles the negotiation of the protocol parameters, such as the encryption algorithms, authentication methods, and compression options.
It also includes the protocol for forwarding ports and X11 connections. The Connection Layer is the most important layer of the SSH protocol as it provides the security and privacy of the session.
The standard channel types of the Connection Layer are:
1. Shell: This channel is used to run commands and programs on the remote host that the user has access to.
2. Direct-tcpip: This channel is used to establish a direct connection between two hosts without any intermediate hops.
3. Forwarded-tcpip: This channel is used to forward a connection from one host to another through an intermediate hop.
4. X11: This channel is used to provide a graphical user interface to the remote host.
5. Sftp: This channel securely transfers files between two hosts.
6. Agent: This channel is used to store and access private keys securely.
7. Auth-agent: This channel securely stores and access user authentication data.
Difference Between SSH and Telnet
SSH (Secure Shell) and Telnet are both network protocols that are used to connect to remote computers. However, they are very different in terms of security and functionality.
Telnet is an unsecured protocol that transmits data in clear text. This means that anyone who is able to intercept the data can easily read it. This makes it vulnerable to attackers who can steal passwords and other sensitive information. Furthermore, Telnet does not provide any encryption, which means that the data is sent in plain text and can be easily read by anyone on the network.
On the other hand, SSH is a secure protocol that uses encryption to protect data in transit. It uses public-key cryptography and challenge-response authentication to ensure that only authorized users can access the remote computer. SSH also provides additional authentication methods, such as one-time passwords and two-factor authentication. Furthermore, SSH provides secure file transfers and tunneling, which allows for secure communication between two computers over an unsecured network.
In summary, SSH is much more secure than Telnet and is generally the preferred choice when connecting to a remote computer. It provides secure file transfers, tunneling, and additional authentication methods that make it much more difficult for attackers to gain access to the server.
History of SSH Protocol
The Secure Shell (SSH) protocol is a secure cryptographic network protocol used to perform remote shell services, secure file transfers, and secure remote logins. SSH is a secure replacement for the Telnet, rlogin, rsh, and ftp protocols, which transmit data unencrypted, making it vulnerable to interception.
The SSH (Secure Shell) protocol was developed in 1995 by Tatu Ylönen, a researcher at the Helsinki University of Technology (now Aalto University) in Finland.
SSH has undergone several versions since its initial release.
Version 1: This version of the SSH protocol was released in 1995 and is now considered insecure. It uses RSA encryption and uses a single shared key for authentication. Version 1 also lacks integrity protection, making it vulnerable to man-in-the-middle attacks.
Version 2: The exact release date of the first implementation of SSH version 2 is not publicly available, but it was first specified in 1998 in RFC 4250. The OpenSSH open-source implementation of the protocol, which is widely used today, released version 2.0 in 1999.
This version of the SSH protocol was more secure than Version 1. It uses a better public key cryptography system, which includes an integrity protection system, as well as improved key exchange. In 2006, the Secure Shell (SSH) protocol was updated, and the revised version, SSH-2, was established as a standard by the Internet Engineering Task Force (IETF).
Version 1.99: This version of the SSH protocol was a hybrid between Version 1 and Version 2. It uses Version 2’s public key cryptography system but also retains the single shared key from Version 1. It is considered secure, but some security experts do not recommend its use.