Connected: An Internet Encyclopedia
SSH Protocol Overview

Up: Connected: An Internet Encyclopedia
Up: Topics
Up: Functions
Up: Security
Prev: SSL/TLS Protocol Overview
Next: IPSEC Protocol Overview

SSH Protocol Overview

SSH Protocol Overview The most common means of remote login today (2001) is SSH, both a program and a protocol by the same name. Though remote login is the primary use of SSH, the protocol can be used as a general purpose cryptographic tunnel, capable of copying files, encrypting email connections, and triggering remote execution of programs.

SSH Version 1, developed in 1995, is being phased out in favor of SSH Version 2, currently (2001) being standardized by the IETF's Secure Shell Working Group. Other important SSH-related links include:

SSH operates over TCP. In its simplest mode of operation, it connects to a server, negotiates a shared secret key using Diffie Hellman, then begins encrypting the session (typically using the Blowfish cipher). A username and password are passed over the encrypted session and, if authenticated, the server starts a command shell over the encrypted session. Thus, in its simplest use, SSH represents a more secure alternative to TELNET. I particularly like to use the MindTerm Java applet, which allows encrypted logins from systems that don't have SSH clients - all you need is a web browser capable of running Java applets.

In more advanced usage, ssh allows the creation of RSA or DSA asymmetric key pairs. The private key is stored in an identity file, possibly encrypted using a passphrase. The public key can be copied freely around the network, usually ending up in a user's list of authorized keys. A ssh client, properly authenticated with a private key matching one of the authorized public keys, is allowed to login without supplying a password. This can be used to login without a password, though in practice I've found this of limited utility, since passwords should still be used to ensure security. Of more interest is the ability to automate remote processes, allowing a trusted program to authenticate itself with an RSA or DSA key and execute commands on the remote system.

SSH supports generic tunneling, so it can be used to encrypt windowing system traffic, for example, operating X Windows over a encrypted session. It's ability to execute remote commands make it a common transport for other commands, such as rsync (incremental file transfer) and cvs (distributed version control). For example, after established a DSA trust relationship between two hosts, a periodic cron job could use rsync to download any changed files once every 24 hours, using ssh to authenticate and encrypt the transaction. I do not recommend using SSH to setup a virtual private network (VPN), tunneling arbitrary IP packets over PPP-in-SSH, as some people have done. IPSEC is a better solution for VPNs.

In summary, SSH is a popular and powerful tool for encrypting TCP sessions over the Internet, most commonly used for remote login, but with other utility as well.


Next: IPSEC Protocol Overview

Connected: An Internet Encyclopedia
SSH Protocol Overview