SSH, short for Secure Shell, is a cryptographic network protocol that runs network services, most often remote login and command execution, over a network that others can read. It uses public-key cryptography to check the server and, when needed, the user. The default port is 22. The most commonly implemented software is OpenSSH, which runs on Unix-like systems.1
History of SSH
Creator: Tatu Ylönen (1995); OpenBSD developers (OpenSSH, 1999). Year: 1995.
Finnish computer scientist Tatu Ylönen designed SSH in 1995. He also wrote the first version. It had two commands, ssh and slogin. They replaced the rsh and rlogin tools. Those tools sent passwords as plain text. Telnet had the same weakness. SSH encrypts the data stream. An observer who reads all the traffic cannot read the passwords.
Several groups then developed SSH and made their own versions. The protocol names two versions, SSH-1 and SSH-2. The OpenBSD developers released OpenSSH as open-source software in 1999. OpenSSH became the most commonly implemented version. It removed SSH-1 from its code in release 7.6. So the project supports only SSH-2.
SSH uses a client and a server. The transport layer gives server authentication, privacy and data checks. The user authentication layer checks the user. The connection layer splits the encrypted tunnel into channels. One login can then carry a shell, file transfers and forwarded ports. RFC 4251, RFC 4253 and RFC 4254 define the three layers.
The protocol uses public-key cryptography. Each side holds a key pair. The server proves its identity with its host key. A user can sign in with a key file instead of a password. OpenSSH runs on most operating systems. Some embedded devices also run SSH.
Changelog and latest update
The IETF published RFC 4251, RFC 4253 and RFC 4254 in January 2006. They are the base standards for SSH-2. Later documents update them. RFC 8308 updates RFCs 4251, 4252, 4253 and 4254. It defines extension negotiation. RFC 4253 says the server normally listens on TCP port 22, a port registered for SSH. RFC 8268 updates RFC 4253 and adds more MODP Diffie-Hellman groups that use SHA-2 hashes.
OpenSSH 7.6 removed SSH-1 from the code. OpenSSH 9.0 came out on 8 April 2022. It made scp use the SFTP protocol by default. The OpenSSH release notes list each version with its date. Each entry names the security fixes in that release.
The project keeps releasing versions with fixes. Its release notes give the date of each version, such as OpenSSH 9.0 on 8 April 2022 and OpenSSH 10.6 on 6 October 2026. Each entry names the security fixes in that release.
Latest update: OpenSSH 10.6, 2026-10-06
OpenSSH 10.6 came out on 6 October 2026. The release notes page lists it. The release is on the mirrors that openssh.com lists. The notes list the changes in this version, including fixes for bugs and security problems.
Usage examples
An SSH session starts with a host name, a user name and a port. Port 22 is the default, so the port option is needed only when a server listens on another port. Keys replace passwords for most automated work. The client keeps the settings in a config file, and the ssh command reads the config file for each host name. The five examples show a login, the creation of a key pair, a config entry, a remote command and a local port forward.
ssh -p 22 jane@server.example.comThe ssh command opens an encrypted session to the host server.example.com as the user jane. The p option sets the port, and 22 is the default port for SSH, so the option only changes the value when the server uses another port. After the login, the shell of the user runs on the server.
ssh-keygen -t ed25519 \
-C "jane@example.com"The keygen command creates a key pair of the Ed25519 type. The private key stays on the local computer, and the public key is copied to the server in its authorized keys file. The C option adds a comment that names the key owner in the file.
Host web
HostName server.example.com
User jane
Port 22
IdentityFile ~/.ssh/id_ed25519The config file lets the name web stand for the full host, user, port and key file. After this entry, the command ssh web makes the same connection as the full command. The IdentityFile line names the private key that the client uses for sign-in.
ssh jane@server.example.com "df -h /"The ssh command runs df with the h option on the server and prints the disk usage of the root file system. The client closes the session after the command ends. This method works in scripts that need one value from a remote machine.
ssh -L 8080:localhost:80 \
jane@server.example.comThe L option forwards port 8080 on the local computer to port 80 on localhost as seen from the server. A browser on the local computer then opens localhost port 8080 to reach the web server, while the traffic travels inside the SSH tunnel.
References
These sources are outside Websnoogie and were checked on 2026-10-12.
Secure Shell
Wikipedia
The encyclopedia article on SSH. It covers the 1995 design by Tatu Ylönen. It describes SSH-1 and SSH-2 and the OpenSSH history from 1999. It also covers the three protocol layers. Its references point to the RFCs and to the OpenSSH release notes.
RFC 4251: The Secure Shell (SSH) Protocol Architecture
RFC Editor (IETF)
The IETF document from January 2006. It describes the architecture of SSH-2. It defines the transport, user authentication and connection protocols. It also names the security services that SSH provides.
RFC 4253: The Secure Shell (SSH) Transport Layer Protocol
RFC Editor (IETF)
The IETF document from January 2006. It defines the SSH transport layer. It covers server host keys and key exchange. It explains how packets are encrypted. It names TCP port 22 as the default listening port.
RFC 4254: The Secure Shell (SSH) Connection Protocol
RFC Editor (IETF)
The IETF document from January 2006. It defines the connection protocol. It describes channels and requests. It defines port forwarding, which the local forward example on this page uses.
OpenSSH Release Notes
OpenSSH project
The release notes for each OpenSSH version. The page lists OpenSSH 10.6, released on 6 October 2026. It also lists OpenSSH 9.0 from 8 April 2022. Each entry lists its changes and its security fixes.
Three checks before we touch a server
We run three checks before we connect to a client server. First, we confirm the server name and the key it presents, so we know we are on the right machine. Second, we limit who can log in and which network addresses can reach the door. Third, we review the access log for failed attempts. SSH (Secure Shell) is the encrypted way to manage a server from a distance, and each check protects your files.
For a small business, the gain is simple. A server with tight login rules stays online and keeps customer records private. Our work since 2004 has taught us to check the basics first: the keys, the open doors and the log. We explain each finding in plain words, so you know what changed, why it changed and what it means for your site.
Server checks can be part of a new website. A new site costs $300, one time, and takes 3 to 5 days to deliver. Ask about your server by phone at 402-813-4034. We answer from 7 am to 10 pm every day.
