- The SSH protocol establishes an encrypted communication channel for remote administration of operating systems.
- Authentication can be managed using the traditional username and password method or through public and private key pairs.
- There are multiple Windows clients that allow you to securely run commands on Linux or Windows servers.
- Symmetric encryption, asymmetric encryption, and hashing ensure that information is not intercepted or manipulated.
You've probably encountered the need to manage a server that you don't have physically in front of you. To do this without any hacker with half a brain stealing your keys, SSH (Secure Shell) comes into play , a protocol that has become the absolute standard for navigating the console of remote machines without fear.
Basically, it's like opening a magic window that lets you type commands on a computer that could be on the other side of the world, ensuring that all data traffic is encrypted. If you have a VPS or work in the cloud, mastering this tool is simply essential to avoid making mistakes.
What exactly does the SSH protocol consist of?
To understand this properly, we need to look back and remember Telnet. Telnet was once used for the same purpose, but it had a serious problem: it sent everything in plain text. If someone intercepted the connection, they could read your password as if it were an open book. SSH was created to solve this, implementing a robust encryption system that makes the information unreadable to third parties.
This protocol operates on a client-server architecture. The SSH server is the software that runs on the remote machine and "listens" for requests on a specific port (22 by default). The SSH client , on the other hand, is the application you install on your own PC to initiate the connection and send commands.
The pillars of security: Encryption and Hashing
The magic of SSH lies in the fact that it doesn't use a single protection method, but a combination of three very powerful mathematical techniques:
- Symmetric Encryption: It is used for constant communication. Both the client and the server share a Secret password to encode and decode the data. To prevent this key from traveling across the network, they use algorithms such as Diffie-Hellman.
- Asymmetric Encryption: It is primarily used for authentication. Here is a pair of keys: one public key that can be anywhere and a private key that only you possess. If the server has your public key, it can send you a challenge that only you can decrypt with your private key.
- Hashing: This technique is used to verify that no one has touched the data during the journey. A unique hash value (using MD5 or SHA); if the message is altered even by a single bit, the hash changes and the connection is marked as unreliable.
How to connect to a server from Windows
Windows used to be a headache for this, but nowadays there are options for all tastes, from those who prefer clicking to those who love the command line.
Option 1: Using the Terminal (OpenSSH)
Modern versions of Windows 10 and 11 already include a built-in OpenSSH client. Simply open Command Prompt (CMD) or PowerShell and type the command. ssh user@ip-addressFor example, if you want to log in as root to a server, you would type ssh [email protected]The system will ask if you trust the host; you type Yes and then you enter the password (note that when you type it you will not see asterisks or periods, this is normal for security).
Option 2: PuTTY (The classic)
PuTTY is the legendary tool for Windows. To use it, download the executable, enter the server's IP address in the Host Name field, and verify that the port is 22. Clicking "Open" will open a console where you'll be prompted for your username and password. It's ideal if you're looking for something lightweight and simple.
Option 3: Advanced Tools
If you manage many servers, you might prefer MobaXterm or Termius . These applications allow you to save sessions, manage SSH keys visually, and even include SFTP for drag-and-drop file transfers, saving you a lot of time.
Authentication Methods: Passwords vs. SSH Keys
While logging in with a username and password is the most common method, it's not the most secure. Brute-force attacks are constant and can take down your server. Therefore, using an SSH key pair is highly recommended.
To create these keys in Windows, you can use the command ssh-keygenThis will generate two files: one private (id_rsa) and one public (id_rsa.pub). You must upload the public key to the server, usually saving it in the file ~/.ssh/authorized_keysOnce this is done, you will be able to access the server without entering passwords, as authentication is done through the cryptographic handshake between your two keys.
File management and secure tunnels
SSH isn't just for issuing commands. It also allows you to transfer files securely using SFTP (Secure FTP) or SCP. While traditional FTP is insecure, SFTP leverages the SSH channel to keep your files protected during transmission.
Another powerful feature is port forwarding . This allows you to create an encrypted tunnel to access internal services on a private network (such as a MySQL database) without exposing those ports directly to the entire internet, thus avoiding critical vulnerabilities in your infrastructure.
Tips for securing your SSH server
If you've just set up your VPS, don't leave it with the factory settings, as this leaves you vulnerable to attacks. Here are a few recommendations for peace of mind:
- Change port 22: Bots are constantly scanning port 22. Changing it to a random port (like 2200) will drastically reduce the noise in your logs.
- Disable root access: It's best to log in with a normal user account and use
sudo. You can configurePermitRootLogin prohibit-passwordin the sshd_config file, applying techniques of root privilege management. - Implement a Timeout: setup
ClientAliveIntervalso that inactive sessions close automatically and do not remain open rear doors through carelessness.
Mastering the Secure Shell protocol is the first step for anyone who wants to take full control of their remote infrastructure. From installing a simple client on Windows to configuring tunnels and asymmetric keys, this tool ensures efficient server management and, above all, impenetrable access to prying eyes.
