Every day, millions of administrators log into remote servers by typing a short command into a terminal. That command opens an encrypted tunnel through the internet and hands them full control of a machine that might be sitting in a data center thousands of miles away. The protocol making that possible is SSH, Secure Shell, and it is one of the most useful tools in computing. It is also one of the most targeted.
What SSH Actually Does
SSH is a network protocol that lets users connect to a remote computer securely over an unsecured network. Before it existed, administrators used tools like Telnet, which sent usernames, passwords, and commands in plain text across the wire. Anyone sitting on the same network could read every keystroke. SSH replaced that with strong encryption, making eavesdropping impractical.
By default, SSH listens on port 22. When a user connects, the two machines perform a cryptographic handshake that verifies identities and establishes an encrypted session. Everything exchanged after that point, commands, file transfers, and output, is protected from outside eyes.
SSH runs on virtually every Linux server in existence, and it is standard on macOS and most Unix-like systems. Windows 10 gained a built-in SSH client starting with its April 2018 update, along with an optional SSH server component. The protocol is the backbone of modern cloud infrastructure, used to manage everything from small virtual private servers to vast fleets of cloud machines.
Authentication can happen in two ways. The simpler method uses a username and password. The stronger method uses a cryptographic key pair: a private key stored on the user’s machine and a public key stored on the server. Key-based authentication is significantly harder to attack because there is no password to guess or steal.
How Attackers Exploit It
The most common attack against SSH is also the most straightforward: automated brute-force scanning. Attackers run programs that continuously probe internet-connected servers on port 22, trying thousands of username and password combinations per minute. Any server with a weak password, or one that still accepts the default username “root” with a guessable password, is at serious risk. Honeypot operators and server administrators routinely report a constant stream of such login attempts against port 22, often within minutes of a server going online.
Credential stuffing is a related threat. When large databases of usernames and passwords leak from other services, attackers feed those credentials into SSH scanners. If someone reused a password from a breached website on their server, that server may fall within hours of the breach becoming public.
Beyond password attacks, SSH has occasionally suffered from implementation vulnerabilities. In July 2024, a critical vulnerability nicknamed “regreSSHion” was disclosed in OpenSSH, the most widely used SSH implementation. The flaw affected a large number of Linux systems running certain versions of OpenSSH and, under specific conditions, could allow an unauthenticated attacker to execute arbitrary code as root. Security teams across the industry moved quickly to patch affected systems, but the episode was a reminder that even mature, well-audited software can harbor serious flaws.
Attackers also look for misconfigured SSH setups: servers that permit root login over the network, systems that allow password authentication when key-based authentication should be enforced, or machines running outdated versions of OpenSSH with known bugs.
How to Reduce Your Risk
The single most effective step any administrator can take is switching to key-based authentication and disabling password login entirely. This eliminates the brute-force problem almost completely, because there is no password to guess.
Moving SSH off port 22 reduces the volume of automated noise hitting your logs, though security professionals are careful to note this is not a real security measure on its own. A determined attacker will scan all ports. Fail2ban, a widely used open-source tool, automatically blocks IP addresses that produce too many failed login attempts, which helps manage automated scanning.
Keeping OpenSSH updated is critical. The regreSSHion vulnerability in 2024 demonstrated that patching is not optional. Most Linux distributions push security updates automatically or with minimal configuration, and enabling that feature costs nothing.
For administrators managing a hardware security key for two-factor authentication, adding a second factor on top of SSH key authentication provides another layer of defense for particularly sensitive systems.
SSH is not going away. It is too useful, too deeply embedded in the infrastructure of the internet. The goal is not to fear it but to configure it carefully, keep it patched, and understand what you are exposing when you open that door to the outside world.
As an Amazon Associate, The Rough Idea earns from qualifying purchases.