Secure Shell (SSH)

Definition

Secure Shell (SSH) is a secure application-layer protocol that enables users to remotely log in to another computer, transfer files securely, and execute commands over an encrypted network connection.

SSH was originally developed as a secure replacement for TELNET, which transmits all data, including usernames and passwords, in plain text.

There are two versions of SSH:

• SSH-1 – Older version with known security flaws (deprecated).
• SSH-2 – Current and secure version, widely used today.

SSH uses TCP as the transport protocol and listens on port 22.

---

Need for SSH

TELNET provides remote login but suffers from major security issues:

• Passwords are sent in plain text.
• Commands are sent in plain text.
• Anyone intercepting the communication can read or modify the data.

SSH overcomes these problems by providing:

• Encryption (Confidentiality)
• Authentication
• Data Integrity
• Secure File Transfer

---

SSH Architecture

SSH is built on top of TCP and consists of three protocols (components).

Application
      │
SSH Connection Protocol (SSH-CONN)
      │
SSH Authentication Protocol (SSH-AUTH)
      │
SSH Transport Protocol (SSH-TRANS)
      │
TCP

Each protocol performs a specific task to establish secure communication.

---

Components of SSH

1. SSH Transport Protocol (SSH-TRANS)

Purpose

SSH-TRANS establishes a secure communication channel over TCP.

Initially, TCP creates a normal (insecure) connection. SSH-TRANS then performs security operations to convert it into a secure encrypted channel.

Services Provided

SSH-TRANS provides four important security services:

1. Confidentiality (Privacy)

• Encrypts all transmitted data.
• Prevents attackers from reading messages.

2. Data Integrity

• Ensures messages are not modified during transmission.
• Detects tampering by attackers.

3. Server Authentication

• Verifies that the client is communicating with the genuine server.
• Prevents impersonation attacks.

4. Compression

• Compresses data before transmission.
• Improves transmission efficiency.
• Makes cryptographic attacks more difficult.

---

2. SSH Authentication Protocol (SSH-AUTH)

Purpose

After the secure channel is established, the client must prove its identity to the server.

SSH-AUTH authenticates the client.

Working

1. Client sends:
   • Username
   • Server name
   • Authentication method
   • Authentication information
2. Server verifies the client's credentials.
3. Server sends either:
   • Success (authentication accepted)
   • Failure (authentication rejected)

Thus, both client and server can trust each other.

---

3. SSH Connection Protocol (SSH-CONN)

Purpose

After secure communication and authentication are completed, SSH-CONN manages communication between the client and server.

Main Function – Multiplexing

SSH-CONN allows multiple logical channels over a single secure SSH connection.

Each channel can be used independently.

Examples:

• Remote login
• File transfer
• Remote command execution
• Port forwarding

Thus, multiple applications can share one encrypted SSH connection.

---

Working of SSH

The complete SSH communication occurs in the following sequence:

Client
   │
TCP Connection Established
   │
SSH-TRANS
(Secure Channel Created)
   │
SSH-AUTH
(Client Authentication)
   │
SSH-CONN
(Multiple Secure Channels)
   │
Remote Login / File Transfer / Commands

---

Applications of SSH

1. Remote Login

SSH securely allows users to access remote computers.

Popular SSH clients include:

• PuTTY
• OpenSSH
• Tectia

Example:

ssh user@server.com

---

2. Secure File Transfer

SSH provides secure file transfer using:

SFTP (Secure File Transfer Protocol)

• Transfers files securely over SSH.
• Replacement for FTP.

Example:

sftp user@server.com

---

SCP (Secure Copy)

Used for securely copying files between systems.

Example:

scp file.txt user@server:/home/user/

---

3. Port Forwarding (SSH Tunneling)

One important feature of SSH is Port Forwarding.

Purpose

Some application protocols (such as TELNET, FTP, and SMTP) do not provide security.

SSH creates an encrypted tunnel through which these insecure protocols can safely communicate.

This technique is called:

• SSH Port Forwarding
• SSH Tunneling

Working

FTP Client
      │
 SSH Client
      │
========================
 Encrypted SSH Tunnel
========================
      │
 SSH Server
      │
FTP Server

Although FTP itself is insecure, all FTP traffic travels through the encrypted SSH tunnel.

---

SSH Packet Format

An SSH packet contains the following fields:

Field	Purpose
Length	Specifies the length of the packet
Padding	Adds random bytes (1–8 bytes) to improve security
Type	Identifies the SSH protocol message type
Data	Contains the actual information being transmitted
CRC (Cyclic Redundancy Check)	Detects transmission errors

Purpose of Padding

Padding makes encrypted packets appear to have different lengths, making cryptographic attacks more difficult.

---

Advantages of SSH

• Provides secure remote login.
• Encrypts all communication.
• Authenticates both client and server.
• Ensures message integrity.
• Supports secure file transfer.
• Supports multiple logical channels.
• Provides secure tunneling for insecure protocols.

---

Limitations of SSH

• Slightly higher processing overhead due to encryption.
• Initial setup is more complex than TELNET.
• Encryption may introduce minimal latency.

---

SSH vs TELNET

Feature	SSH	TELNET
Full Form	Secure Shell	TErminaL NETwork
Security	Encrypted	Plain text
Password Protection	Yes	No
Authentication	Strong client and server authentication	Basic authentication
Data Integrity	Yes	No
Confidentiality	Yes	No
File Transfer	Supports SFTP and SCP	Not supported securely
Port Number	22	23
Current Usage	Widely used	Mostly obsolete (used only for testing/diagnostics)

---

Summary

• SSH (Secure Shell) is a secure application-layer protocol used for remote login, secure file transfer, and secure remote administration.
• It uses TCP port 22 and replaces TELNET by encrypting all communication.
• SSH consists of three protocols:
  • SSH-TRANS – Establishes a secure encrypted channel and provides confidentiality, integrity, server authentication, and compression.
  • SSH-AUTH – Authenticates the client.
  • SSH-CONN – Creates multiple logical channels for services such as remote login, SFTP, SCP, and port forwarding.
• SSH also supports SSH tunneling (port forwarding), allowing insecure protocols such as FTP, TELNET, and SMTP to communicate securely through an encrypted tunnel.