Skip to content

TL;DR ✨

SSH is an abbreviation of secure shell, a name used for both a program and a cryptographic communication protocol that uses TCP/IP.

The protocol was developed as a replacement for the insufficiently secure Telnet protocol. SSH makes it possible to create a secure channel for data communication between two entities, typically in a client-server architecture.

From the archive

This article was first published on 2017-06-12. It is also a snapshot of its time, so some details and recommendations may no longer reflect the current situation.

SSH is an abbreviation of secure shell, a name used for both a program and a cryptographic communication protocol that uses TCP/IP.

The protocol was developed as a replacement for the insufficiently secure Telnet protocol. SSH makes it possible to create a secure channel for data communication between two entities, typically in a client-server architecture.

The protocol specification includes two mutually incompatible versions, SSH-1 and SSH-2.

SSH-1 is the original version of the protocol, released as freeware in Finland in 1995 by researcher Tatu Ylönen, who later founded SSH Communications Security Oyj.

SSH-2 is an improved version of the protocol that includes several important security additions, such as the Diffie-Hellman cryptographic key-distribution protocol. Today, SSH-2 is regarded as a standard in the IT world.

SSH has found many practical, everyday uses.

  • It effectively replaces insecure protocols such as Telnet, rlogin, and rsh.

  • SSH can replace the insecure FTP protocol and thus provide secure data transfer between two machines.

  • SSH can be used to create a tunnel.

Perhaps the best-known computer program providing encrypted sessions and using the SSH protocol is OpenSSH (OpenBSD Secure Shell), which was used by more than two million users worldwide in 2000. OpenSSH has a client component and a server component. This article takes a closer look at it.

Using an OpenSSH server, the article demonstrates:

  1. A simple, secure client-to-server connection without password authentication, using keys

  2. An SSH tunnel for quick access to another network without having to configure, for example, a VPN tunnel

Installation on the server

The server component is easy to install on a remote machine using the command

sudo apt-get install openssh-server

Next, the OpenSSH server settings on the remote machine need to be edited. The command below opens the OpenSSH server configuration file, where some of the most interesting options can be examined:

sudo nano/etc/ssh/sshd_config

  • Port—the port on which the daemon listens. It can be changed freely from its default value, and the change takes effect immediately after the SSH server is restarted.

  • PubkeyAuthentication—a variable that permits authorization through asymmetric private- and public-key cryptography instead of a password.

  • PasswordAuthentication—this enables authentication using a password.

  • PermitRootLogin—this controls whether direct root access to the server is permitted or denied.

  • AuthorizedKeysFile—this variable can be used to change the absolute path to the keys.

  • X11Forwarding—as the name suggests, this makes it possible to display certain applications from the machine running the OpenSSH server graphically through a tunnel, and enables SSH forwarding.

The SSH server can be edited according to the syntax shown directly in the configuration file. Usually it is enough to uncomment a variable or simply change yes to no, or vice versa. In some cases, such as PermitRootLogin, specific terminology is expected. In short, the required variables should be enabled or adjusted for the intended purpose.

After saving the edited file, stop and start the OpenSSH server service with this command:

sudo service ssh restart

🔐 1. Secure client-server connection using SSH and keys

The openssh-client package must be available on the local client machine. The OpenSSH client is included by default in all distributions, but if it is not installed, install it on Debian with:

sudo apt-get install openssh-client

OpenSSH includes several supplementary tools for full-featured operation. For this article, the most interesting one is ssh-keygen, which is used to create keys.

On the local computer, the OpenSSH client can be configured through the file at /etc/ssh/ssh_config.

The author does not edit it here; this information is included only as a supplement. The example instead demonstrates how to generate an RSA key on a local machine using ssh-keygen, then import the newly generated key into the OpenSSH server as an authorized access key.

On the local machine, enter the following command as the current user:

ssh-keygen -t rsa

Simply accept all the prompts. Notice that a total of two keys have been generated:

  • id_rsa (private key)—protect it and never give it to anyone.

  • id_rsa.pub (public key)—this can be imported freely into different machines running openssh-server.

On the machine running the OpenSSH server, copy the contents of the public key id_rsa.pub under the relevant user account, and create a file named authorized_keys in the ~/.ssh directory. Paste the entire contents of the client's id_rsa.pub into this file.

Logging in without a password is then easy. On the local machine, enter:

ssh VzdalenyServerUserlogin@IpAdresaSSH-serveru -p Port

🔐 2. SSH forwarding

Imagine a situation in which someone needs to reach port 80 on a remote server, where apache2 is listening, but has no access to the main firewall and no option to use a VPN tunnel. One possible solution is SSH forwarding.

Another typical example is having a VPN concentrator that is also an SSH server and not wanting to connect through the VPN. Only the VPN client's web port needs to be reached. In this situation, too, the simplicity of SSH forwarding is helpful.

SSH forwarding is a mechanism for tunneling only a particular port over SSH and opening it for local access. There are many variations of SSH forwarding; this example demonstrates forwarding a particular port locally to the user's own machine in order to access that port.

A change must be made to the configuration file on the server side.

sudo nano/etc/ssh/sshd_config

Find the X11Forwarding variable, uncomment it, and leave its value set to yes:

X11Forwarding yes

🔐 The SSH daemon must be restarted with the command

sudo service ssh restart

Before examining SSH forwarding itself, the variables must be defined.

  1. OpenSSH server—this is a separate server with the public address PIP. The OpenSSH server service runs on it under Port3.

  2. Remote machine—this is the machine of interest, located in the same subnet as the OpenSSH server. The OpenSSH server can reach this remote machine. The machine has Port2, which is to be mapped so that it is visible on the local machine.

  3. Local machine—this is the user's computer, where Port1 will be opened. Port2 from the remote machine will be mapped to Port1.

✨ A diagram is included for an even clearer explanation

On the local Linux machine, enter the following command, whose parts are explained below:

ssh -L Port1:LIP:Port2 UserLogin@PIP -p Port3

  • SSH - L indicates that this is local SSH forwarding.

  • Port1 is the port that will open on the local PC; the remote service will listen on this port.

  • LIP is the local IP address of the machine whose port is being mapped.

  • Port2 is the port being mapped on the remote machine—the port that needs to be reached.

  • UserLogin is the login used when signing in to the SSH server.

  • PIP is the server's public IP address.

  • Port3 is the port on which the OpenSSH server listens.

On Linux, a specific command might look like this:

ssh -L 8406:172.23.12.55:8406 connectica@1.1.1.1 -p 7405

🔍 Configuration in PuTTY

On PuTTY's initial screen, configure the connection to the remote machine

using the format Host name = PIP

Port = Port3

  1. In PuTTY, open the SSH - tunnels section at the bottom left.

  2. Enter Port1 in the Source port field.

  3. Enter LIP:Port2 in the Destination section.

  4. Confirm with the Add button, then click Open to establish the tunnel easily.

Once the tunnel has been established successfully, the port can be reached by entering, for example, 127.0.0.1:Port1 in a web browser, which opens the service through the local machine.