Networking · Protocols
SSH
Secure Shell provides encrypted remote administration, file transfer and tunnelling, usually on TCP/22.
FoundationalUpdated 2026-09-01
Overview
SSH authenticates the server by host key and the user by password, public key or certificate. Key based authentication with a passphrase protected private key, or short lived SSH certificates, is the enterprise standard.
SSH also provides port forwarding and SOCKS proxying, which is useful for administration and equally useful to an attacker for pivoting, so tunnelling should be restricted where it is not required.
Security considerations
- Disable root login and password authentication; centralise authorised keys or use an SSH CA.
- Restrict administrative access to jump hosts and privileged access workstations, and record sessions for privileged targets.