SSH

In short: Secure Shell — an encrypted protocol for remote access to a computer via a command line, standard port 22.

In more detail: Replaces older unencrypted protocols such as Telnet. Authentication runs via password or — much more securely — via the key-and-lock principle with a public key/private key. Also forms the transport basis for SFTP and SCP and can be repurposed for port forwarding/tunnelling.

In Depth

Internally, SSH is structured into three sub-protocols that build on each other: SSH-TRANS establishes the basic encrypted connection and checks the server fingerprint (protection against man-in-the-middle attacks), SSH-USERAUTH authenticates the user on top of it, and SSH-CONNECT manages several logical channels at the same time on the authenticated connection (multiplexing) — e.g. an interactive shell AND a forwarded port connection in parallel.

A typical login command: ssh user@server.example.com (password login) or ssh -i ~/.ssh/id_ed25519 user@server.example.com (with an explicit private key). Public-key authentication is considered much more secure than passwords, because the private key never leaves the user’s computer — the server only checks whether the client can prove mathematically that it possesses the private key matching the stored public key, without it ever being transmitted. SSH tunnelling (port forwarding over an existing SSH connection) is a popular technique for, say, routing a database connection securely through a firewall without exposing the database port itself publicly.

See also: SFTP, Key-and-lock principle, Tunnel