{"data":[{"number":22,"slug":"22-ssh","name":"SSH","brief":"<p><strong>Secure Shell (SSH)</strong> is a widely-used network protocol designed to provide secure access and communication with remote systems over an unsecured network. It encrypts login credentials, command execution, file transfers, and tunneling capabilities, making it a fundamental tool for system administrators and developers to securely manage servers and devices.</p>","commonUsage":"Secure remote access","protocols":["tcp","udp"],"transport":{"tcp":true,"udp":true,"sctp":false},"official":true,"encrypted":true,"range":"well-known","risk":{"score":4,"level":"caution"},"categories":[{"name":"Security","slug":"security"},{"name":"Remote Access","slug":"remote-access"},{"name":"Network Services","slug":"network-services"}],"views":20349,"updatedAt":"2026-08-13T12:29:35.920Z","url":"https://whatportis.com/ports/22-ssh","description":{"technical":"<p><strong>SSH (Secure Shell)</strong> is a cryptographic network protocol enabling secure communication between a client and a remote server. It was developed as a secure replacement for older, insecure protocols such as Telnet and rlogin. Through the use of strong encryption algorithms and key-based authentication, SSH ensures confidentiality and data integrity during sessions.<br /><br />At its core, SSH operates over the application layer using TCP port 22 by default. The protocol initiates with a handshake where the server presents its public host key, which the client verifies to prevent man-in-the-middle attacks. Upon successful verification, both sides negotiate encryption and compression algorithms, establishing a secure channel.<br /><br />SSH supports a range of functionalities including remote command execution, secure file transfer protocols (such as SCP and SFTP), forwarding of network ports (tunneling), and multiplexing multiple encrypted channels over a single connection. These capabilities facilitate secure system administration, automation, backups, and development workflows, especially in UNIX/Linux environments, routers, and cloud infrastructure.</p>","security":"<p><strong>Common Vulnerabilities:</strong></p><ul><li><strong>Weak or default credentials:</strong> Attackers exploit default or easily guessable passwords to gain unauthorized access.</li><li><strong>Unrestricted access:</strong> Open SSH ports can be targeted for brute-force or credential stuffing attacks.</li><li><strong>Outdated SSH server versions:</strong> Older versions may have vulnerabilities such as information leakage or susceptibility to downgrade attacks.</li><li><strong>Poorly managed host keys:</strong> Unverified or reused host keys can enable man-in-the-middle (MITM) attacks.</li><li><strong>Improper tunneling controls:</strong> SSH tunneling may be abused to bypass network policies or exfiltrate data.</li></ul><p><strong>Common Mitigations:</strong></p><ul><li><strong>Use strong, unique passwords</strong> combined with multi-factor authentication (MFA) or SSH key-based authentication to prevent unauthorized access.</li><li><strong>Restrict SSH access</strong> to specific IP addresses or networks through firewalls and security groups.</li><li><strong>Change the default SSH port</strong> or implement port-knocking to reduce automated scanning attacks.</li><li><strong>Disable root login</strong> and enforce the principle of least privilege on SSH users.</li><li><strong>Maintain updated SSH server software</strong> with the latest security patches.</li><li><strong>Use intrusion detection tools</strong> and monitor SSH logs for abnormal activity.</li><li><strong>Enforce strong encryption algorithms</strong> and disable insecure options like SSH version 1.</li></ul>"},"references":[],"createdAt":"2025-04-08T07:53:43.526Z"}],"meta":{"count":1,"lookup":"22"}}