RFC 4251 / START HERE
SSH, before the details
SSH: Secure Shell architecture
SSH provides secure remote access and related services over an untrusted network. This RFC introduces the architecture and how its protocol layers fit together.
The idea in one picture
A client contacts a remote host
SSH establishes authenticated access
Protected channels carry the session
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
Remote administration needs protection against eavesdropping and tampering, along with authentication and a way to carry several channels.
A familiar example
An administrator opens an encrypted terminal session to manage a remote server.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Three layers have different jobsSSH combines secure transport, user authentication, and a connection multiplexer.→
- Host keys identify the serverThe client needs a trustworthy binding between a server name and its host key.→
- An unchecked key enables a middlemanAn attacker can create two encrypted connections when the client accepts the wrong host key.→
- One transport carries channelsLogical shell and forwarding channels share an authenticated encrypted connection.→
- Security has endpoint limitsThe encrypted tunnel cannot protect data after a compromised endpoint receives it.→
This introduction explains RFC 4251 (2006). Read the original RFC ↗