Security · intermediate
SSH
SSH is a protocol for creating an encrypted, integrity-protected connection to a remote server, authenticating the server and usually the user, then carrying channels such as an interactive shell, remote command, file transfer, or port forwarding.
Why it matters
SSH is a privileged operational path. Understanding host keys, user keys, agents, channels, and forwarding prevents credential exposure and makes connection failures diagnosable.
Mental model
How to reason about ssh
The client first verifies the server's host key, then proves an allowed user identity, often by signing with a private key. One secured connection can multiplex several independent channels without starting a new transport connection for each.
Analogy
SSH is a verified secure tunnel with multiple labelled lanes: one lane can carry a shell, another a file-transfer subsystem, and another forwarded network traffic.
Examples
See the boundary, not just the happy path
Worked example · Run one remote command
ssh deploy@example.com 'uname -sr'SSH authenticates the remote host and deploy user, opens an execution channel, and returns the remote command's output and exit status. Local shell quoting determines what text reaches the remote shell.
Worked example · Forward a local port
ssh -N -L 15432:127.0.0.1:5432 deploy@example.comThe client listens locally on port 15432 and asks the SSH server side to connect to 127.0.0.1:5432 from the remote host's network context. -N requests no remote command.
Avoid · Blindly replacing a changed host key
ssh-keygen -R example.com && ssh example.comRemoving a stored key without independently verifying the new fingerprint discards protection against server impersonation. A legitimate rebuild and an active attack can produce the same warning.
Common mistakes
Misconceptions to remove early
Sending the private key to the server
Public-key authentication proves possession locally; the private key should remain protected on the client. Install the public key or certificate at the trust point instead.
Confusing local and remote forwarding endpoints
With -L, the listening socket is local and the destination is resolved from the server side. With -R, the requested listener is remote and the destination is reached from the client side.
Quick check
Can you predict the result?
1. What does the stored SSH host key help a client detect?
- • A server presenting a different identity than the one previously trusted.
- • A remote command returning a nonzero exit status.
- • A local file having incorrect Unix mode bits.
2. In ssh -L 15432:127.0.0.1:5432 host, where is 127.0.0.1 interpreted?
Keep building