DEV Community

Cover image for How SSH Actually Works (Step-by-Step for Developers)
DKForge
DKForge

Posted on

How SSH Actually Works (Step-by-Step for Developers)

#linux #networking #security #tutorial

Most developers use SSH every day:

ssh user@server
Enter fullscreen mode Exit fullscreen mode

…but very few know what’s actually happening under the hood.

Let’s break it down 👇

🚀 1. TCP Connection

Everything starts with a basic TCP connection between client and server.

At this stage:

  • No encryption yet
  • Just a raw connection

🤝 2. Negotiation Phase

The client and server exchange:

  • SSH protocol versions
  • Supported encryption algorithms
  • Key exchange methods

They agree on a secure configuration before continuing.

🔑 3. Session Key Generation

SSH uses a key exchange algorithm (e.g. Diffie-Hellman) to generate a shared session key.

Client -------- Key Exchange -------- Server
         -> shared secret key <-
Enter fullscreen mode Exit fullscreen mode

👉 This session key is used for encrypting all communication.

🔐 4. Authentication (Public Key)

If you're using SSH keys:

Generate SSH key 

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"
Enter fullscreen mode Exit fullscreen mode

Copy public key to server 

ssh-copy-id user@server
Enter fullscreen mode Exit fullscreen mode

Or manually: 

cat ~/.ssh/id_rsa.pub
Enter fullscreen mode Exit fullscreen mode

Paste into:

~/.ssh/authorized_keys
Enter fullscreen mode Exit fullscreen mode

👉 The server checks if your public key exists there.

✅ 5. Verification

The server sends an encrypted challenge.

The client decrypts it using its private key.

👉 If successful → authentication is complete.

🔄 6. Encrypted Communication

Now everything is encrypted using the session key:

  • Commands
  • Responses
  • Data

Example:

ls -la
Enter fullscreen mode Exit fullscreen mode

👉 Sent encrypted → executed → returned encrypted

⚡ 7. Command Execution Flow 

Client -> (encrypted command) -> Server
Server -> (execute command)
Server -> (encrypted response) -> Client
Client -> (decrypt response)
Enter fullscreen mode Exit fullscreen mode

🌐 Bonus: SSH Tunneling (Port Forwarding)

SSH can create secure tunnels.

Example: 

ssh -L 3000:localhost:5432 user@remote-server
Enter fullscreen mode Exit fullscreen mode

👉 Now you can connect to the remote DB via:

localhost:3000
Enter fullscreen mode Exit fullscreen mode

🧠 Why SSH Is So Powerful

  • Uses asymmetric cryptography (public/private keys)
  • Establishes a fast symmetric session key
  • Protects against eavesdropping and MITM attacks

🔐 Best Practices 

# Disable password authentication (server-side)
PasswordAuthentication no
Enter fullscreen mode Exit fullscreen mode 
# Set correct permissions
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
Enter fullscreen mode Exit fullscreen mode 
# Use SSH agent
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_rsa
Enter fullscreen mode Exit fullscreen mode

💭 Question

Do you use password authentication or SSH keys in your setup?

Top comments (0)