{"data":[{"number":22,"slug":"22-ssh","name":"SSH","brief":"<p><strong>Secure Shell (SSH)</strong> is a widely-used network protocol designed to provide secure access and communication with remote systems over an unsecured network. It encrypts login credentials, command execution, file transfers, and tunneling capabilities, making it a fundamental tool for system administrators and developers to securely manage servers and devices.</p>","commonUsage":"Secure remote access","protocols":["tcp","udp"],"transport":{"tcp":true,"udp":true,"sctp":false},"official":true,"encrypted":true,"range":"well-known","risk":{"score":4,"level":"caution"},"categories":[{"name":"Security","slug":"security"},{"name":"Remote Access","slug":"remote-access"},{"name":"Network Services","slug":"network-services"}],"aliases":[],"views":20349,"updatedAt":"2026-08-13T12:29:35.920Z","url":"https://whatportis.com/ports/22-ssh","description":{"technical":"<p><strong>SSH (Secure Shell)</strong> is a cryptographic network protocol enabling secure communication between a client and a remote server. It was developed as a secure replacement for older, insecure protocols such as Telnet and rlogin. Through the use of strong encryption algorithms and key-based authentication, SSH ensures confidentiality and data integrity during sessions.<br /><br />At its core, SSH operates over the application layer using TCP port 22 by default. The protocol initiates with a handshake where the server presents its public host key, which the client verifies to prevent man-in-the-middle attacks. Upon successful verification, both sides negotiate encryption and compression algorithms, establishing a secure channel.<br /><br />SSH supports a range of functionalities including remote command execution, secure file transfer protocols (such as SCP and SFTP), forwarding of network ports (tunneling), and multiplexing multiple encrypted channels over a single connection. These capabilities facilitate secure system administration, automation, backups, and development workflows, especially in UNIX/Linux environments, routers, and cloud infrastructure.</p>","security":"<p><strong>Common Vulnerabilities:</strong></p><ul><li><strong>Weak or default credentials:</strong> Attackers exploit default or easily guessable passwords to gain unauthorized access.</li><li><strong>Unrestricted access:</strong> Open SSH ports can be targeted for brute-force or credential stuffing attacks.</li><li><strong>Outdated SSH server versions:</strong> Older versions may have vulnerabilities such as information leakage or susceptibility to downgrade attacks.</li><li><strong>Poorly managed host keys:</strong> Unverified or reused host keys can enable man-in-the-middle (MITM) attacks.</li><li><strong>Improper tunneling controls:</strong> SSH tunneling may be abused to bypass network policies or exfiltrate data.</li></ul><p><strong>Common Mitigations:</strong></p><ul><li><strong>Use strong, unique passwords</strong> combined with multi-factor authentication (MFA) or SSH key-based authentication to prevent unauthorized access.</li><li><strong>Restrict SSH access</strong> to specific IP addresses or networks through firewalls and security groups.</li><li><strong>Change the default SSH port</strong> or implement port-knocking to reduce automated scanning attacks.</li><li><strong>Disable root login</strong> and enforce the principle of least privilege on SSH users.</li><li><strong>Maintain updated SSH server software</strong> with the latest security patches.</li><li><strong>Use intrusion detection tools</strong> and monitor SSH logs for abnormal activity.</li><li><strong>Enforce strong encryption algorithms</strong> and disable insecure options like SSH version 1.</li></ul>"},"references":[{"title":"IANA registry — port 22 (ssh)","url":"https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=22"},{"title":"RFC 4251","url":"https://www.rfc-editor.org/rfc/rfc4251.html"}],"createdAt":"2025-04-08T07:53:43.526Z"},{"number":22,"slug":"22-sftp","name":"SFTP","brief":"SFTP transfers files through an encrypted SSH connection, normally on TCP port 22.","commonUsage":"SFTP clients connect to an SSH server, normally on TCP port 22, and request the SFTP subsystem. It is commonly used for authenticated file exchange and administration instead of legacy FTP.","protocols":["tcp"],"transport":{"tcp":true,"udp":false,"sctp":false},"official":true,"encrypted":true,"range":"well-known","risk":{"score":7,"level":"risk"},"categories":[{"name":"File Transfer","slug":"file-transfer"},{"name":"Remote Access","slug":"remote-access"}],"aliases":[],"views":0,"updatedAt":"2026-08-19T17:57:16.961Z","url":"https://whatportis.com/ports/22-sftp","description":{"technical":"SFTP is the SSH File Transfer Protocol and runs as an SSH subsystem over TCP. The connection begins with the SSH version exchange, followed by SSH key exchange, host-key verification, encryption negotiation, and user authentication; the client then requests the SFTP subsystem. SFTP uses length-prefixed binary packets within the SSH channel, commonly protocol version 3 in OpenSSH deployments. SCP and interactive SSH shell sessions commonly share the same TCP port.","security":"Traffic is encrypted by default when SFTP is used through SSH, but exposed servers remain targets for password guessing, stolen credentials, weak host-key or cipher configurations, and SSH implementation vulnerabilities. Internet exposure should generally be limited to required source networks, with strong authentication, account restrictions, patching, and preferably public-key or equivalent multifactor authentication."},"references":[{"title":"IANA Service Name and Transport Protocol Port Number Registry","url":"https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml"},{"title":"RFC 4253: The Secure Shell (SSH) Transport Layer Protocol","url":"https://www.rfc-editor.org/rfc/rfc4253"},{"title":"RFC 4254: The Secure Shell (SSH) Connection Protocol","url":"https://www.rfc-editor.org/rfc/rfc4254"}],"createdAt":"2026-08-19T17:57:16.961Z"}],"meta":{"count":2,"lookup":"22"}}