What is SSH?
Author: Domeny.ForSale editorial team Published
In brief: SSH (Secure Shell) is a protocol, or a set of communication rules, that lets you securely connect to another computer over a network and run commands on it. It encrypts the data being transmitted, making it suitable for remote server management over the internet as well. To connect, you need a program that supports SSH, the server address, a user account, and a password or a properly configured key.
What is SSH used for?
SSH is most commonly used to work on a remote computer through a terminal, which is a text-based interface. After logging in, you enter commands that run on the server, not on your laptop. This lets you check error logs, update software and change service configurations — within the permissions of your account.
For example, a website on your VPS, or virtual private server, stops working. Through SSH, you can check whether the disk is running out of space, read error messages and restart a service if you have the appropriate permissions. You do not need a graphical desktop on the server to do this.
SSH also has other uses:
- Transferring files through SFTP — a file transfer protocol that operates over an SSH connection. SFTP is not the same as FTP or FTPS.
- Working with Git repositories — an SSH key can authenticate your access when downloading and uploading code changes.
- Tunnelling connections — forwarding traffic from a particular application through an encrypted channel, for example when accessing a database that is not directly accessible from the internet.
How does an encrypted SSH connection work?
On one side, an SSH client runs: a program that initiates the connection. On the other side, an SSH server runs: a service that accepts connections. OpenSSH is a popular implementation of both components. By default, the service listens on TCP port 22; a port is a number that identifies a service on a given device.
When establishing a connection, the client and server agree on security settings and create an encrypted channel. The host key, which identifies the server, allows the client to check which machine it is communicating with. The server then verifies the user’s identity, for example using a password or a user key.
Encryption protects the contents of commands, their output and transferred data from eavesdropping during transmission. However, it does not protect against every threat: an infected laptop can capture data before it is encrypted, and a compromised server can expose it after decryption. SSH also does not hide the fact that the devices are communicating.
How do you connect to a server through SSH?
First, check your hosting provider’s control panel or documentation to see whether your plan includes SSH access. Shared hosting may restrict this feature or the range of available commands. Confirm the host address, username, port and permitted login method — you should not guess these details from the website address.
On Linux and macOS, an SSH client is usually available in the terminal. On Windows, you can use the OpenSSH client if it is installed, for example in PowerShell. The basic command looks like this:
ssh anna (at) serwer.example
Replace anna with your account name and serwer.example with the actual server address or its IP address. If the provider specifies a different port, such as 2222, use:
ssh -p 2222 anna (at) serwer.example
On your first connection, the program will usually display a host key fingerprint, a hash that lets you identify the server’s key. Compare it with information obtained from a trusted source, such as the provider’s control panel or an administrator through an independent channel. Do not accept it automatically just because the program asks for confirmation.
When logging in with a password, the terminal usually does not show the characters you type or any asterisks — this is normal. Once logged in, you can run whoami to check the current username and pwd to see the current directory. The exit command ends the session.
Password or SSH key — which should you choose?
Password login is simple, but a service exposed to the internet can be targeted by automated password-guessing attempts. An SSH key is a good choice for regular administration. However, it does not remove the need to protect the computer where you store it.
An SSH key consists of two linked components: you place the public key on the server, while the private key stays on your device. During login, the client proves that it possesses the private key without sending it to the server. Do not confuse this pair with the host key, which identifies the server itself.
In OpenSSH, you can generate a key pair with this command:
ssh-keygen -t ed25519
Set a passphrase to protect the private key, and do not overwrite an existing key without checking what it is used for. The file ending in .pub contains the public key; add it according to your provider’s instructions. Do not send the private key file to an administrator or technical support.
How can you avoid mistakes and losing access?
A warning about a changed host key may result from the server being reinstalled, but it can also mean that you are connecting to a different machine or that someone is attempting to intercept the communication. First, confirm the cause with the administrator. Removing the saved key solely to make the message disappear bypasses an important security check.
For everyday work, use an account with limited permissions instead of the root account, which has full control over the system. Keep your SSH software updated, and do not run unfamiliar commands without understanding their effects. Changing the port alone is no substitute for proper authentication.
If you want to disable password login, first test key-based access in a second session while leaving the first one open. Before changing the configuration, also find out how to use your provider’s recovery console — this way, a mistake will not lock you out of the server.
See also: What is a CDN?
Read also
