SSH
Also known as: OpenSSH, SSH key, SSH tunnel, Secure Shell, port 22
SSH (Secure Shell) lets you control a remote server over an encrypted connection.
Type a command on your computer; it runs on a server across the world. SSH uses public-key cryptography for authentication -- your private key never leaves your computer. It's the fundamental tool for managing servers and cloud infrastructure.
SSH, explained at three levels
At home
SSH lets you control a remote computer by typing commands into a terminal window on your local computer. The connection is encrypted so nobody can snoop on what you're doing. It's how developers connect to and manage servers on the internet.
At work
System administrators use SSH to manage servers without being physically present. They open a terminal, connect to a remote server with SSH, and can run any command as if sitting at that server -- restarting services, checking logs, editing config files.
At home
SSH uses two authentication methods: passwords (convenient but weaker) and key pairs (a public key stored on the server, a private key kept secret on your computer). Key-based auth is preferred -- even if someone captures your network traffic, they can't use it to log in. SSH config files (~/.ssh/config) store connection shortcuts for multiple servers.
At work
SSH tunneling (port forwarding) routes other protocols through an SSH connection: local forwarding lets you access a database on a private server through an SSH jump host; dynamic forwarding creates a SOCKS proxy. SSH agent forwarding lets you authenticate to further servers using your local key. SSH is also the transport for SCP and SFTP file transfers.
At home
SSH uses asymmetric cryptography for initial key exchange and host authentication, then symmetric encryption (AES-GCM, ChaCha20-Poly1305) for the session. Known_hosts prevents MITM attacks by recording server fingerprints. Modern SSH key types: Ed25519 (recommended), RSA-4096, ECDSA. Key certificates (issued by an SSH CA) scale key management across large server fleets.
At work
Enterprise SSH management involves SSH certificate authorities to issue short-lived certificates (avoiding long-lived key distribution), PAM integration for MFA on SSH login, audit logging via ForceCommand, and bastion hosts that all SSH traffic must route through. OpenSSH's authorized_keys file supports command restrictions and IP allowlists per key. Teleport and HashiCorp Vault Secrets Engine modernize SSH access management with audit trails and temporary credentials.
Real-world examples
At home
Thomas connects to his DigitalOcean server with `ssh user@server-ip`. He stored his SSH public key on the server during setup -- no password needed, and the connection is encrypted. He can run commands, check logs, and restart his app from his laptop.
At work
Nadia's team uses an SSH bastion host. All developers SSH into the bastion first, then from there to internal servers. No production server is directly reachable from the internet -- only the bastion, which has strict logging and MFA requirements.
Common confusions
- SSH is just for Linux servers — SSH works on any operating system. Windows 10+ includes OpenSSH built in. macOS has included SSH for years. Network devices, embedded systems, and IoT devices often run SSH for remote management.
- If you have an SSH password, that's secure enough — Password-based SSH is vulnerable to brute-force attacks. Key-based authentication is strongly preferred -- and many organizations disable password auth entirely, requiring keys or certificates for all SSH access.
For analysts
While BAs rarely use SSH directly, understanding it helps when working with data engineering teams -- SSH tunnels are commonly used to safely connect BI tools to databases on private servers, and SSH key management is a common access control topic in data governance discussions.
History & origin
SSH was created by Tatu Ylonen at Helsinki University of Technology in 1995, following a password-sniffing attack on the university network that exposed the insecurity of Telnet and rlogin. The original SSH was proprietary; OpenSSH (the open-source implementation used almost universally today) was released in 1999 as part of OpenBSD. SSH version 2 (2006) improved security and is the current standard. SSH is embedded in every Linux/macOS system and is the universal tool for server administration.