What is Secure Shell (SSH)?
The secure shell remote access protocol is an IETF suite for protected network services, not simply a remote command interface. Its architecture separates transport, user-authentication, and connection protocols. The transport layer negotiates algorithms, performs key exchange, authenticates the server through its host key, and protects confidentiality and integrity. The user-authentication layer then verifies the client principal through methods such as public keys or passwords; host authentication and user authentication are distinct decisions. Finally, the connection layer multiplexes interactive shells, commands, subsystems, and forwarded channels over one protected session. SSH establishes its own cryptographic transport and does not depend on Transport Layer Security (TLS).
What is Secure Shell (SSH) used for?
SSH supports remote administration, automated operations, secure tunneling, jump or Bastion Host workflows, and SFTP file transfer. Governance should combine verified host keys, strong user authentication, The Principle of Least Privilege (PoLP), key rotation, approved algorithms, session logging, and constrained port or agent forwarding. Automation identities require the same ownership, expiry, and access reviews as human accounts. Material risks include unmanaged private keys, exposed services, permissive forwarding, stolen agents, and weak trust-on-first-use decisions that accept an unverified host key. Leaders should treat the SSH key estate as part of Identity and Access Management (IAM), with inventory, revocation, accountable custodians, and monitored exceptions rather than as scattered administrator convenience files.
