Search documentation of ssh

# SSH Protocol Introduction

Copy Markdown View Source

SSH is a protocol for secure remote logon and other secure network services over an insecure network.

## Scope and Purpose

SSH provides a single, full-duplex, and byte-oriented connection between client and server. The protocol also provides privacy, integrity, server authentication, and man-in-the-middle protection.

The `ssh` application is an implementation of the SSH Transport, Connection and Authentication Layer Protocols in Erlang. It provides the following:

- API functions to write customized SSH clients and servers applications
- The Erlang shell available over SSH, enabled via the `shell` daemon option
- An SFTP client (`ssh_sftp`) and server (`ssh_sftpd`), enabled via the `subsystems` daemon option

## Prerequisites

It is assumed that the reader is familiar with the Erlang programming language, concepts of OTP, and has a basic understanding of public keys.

## Protocol Overview

Conceptually, the SSH protocol can be partitioned into four layers:

    ---
    title: SSH Protocol Architecture (RFC 4251)
    ---

    block-beta
        columns 4

        Shell Exec SFTP Custom
        l1["Connection / Channels\n(RFC 4254)"]:4
        l2["Authentication\n(RFC 4252)"]:4
        l3["Transport\n(RFC 4253)"]:4
        l4["TCP/IP"]:4

### Transport Protocol

The SSH Transport Protocol is a secure, low-level transport. It provides strong encryption, cryptographic host authentication, and integrity protection. A minimum of Message Authentication Code (MAC) and encryption algorithms are supported. For details, see the `ssh` manual page in `ssh`.

### Authentication Protocol

The SSH Authentication Protocol is a general-purpose user authentication protocol run over the SSH Transport Layer Protocol. The `ssh` application supports user authentication as follows:

- Using public key technology. RSA and DSA, X509-certificates are not supported.
- Using keyboard-interactive authentication. This is suitable for interactive authentication methods that do not need any special software support on the client side. Instead, all authentication data is entered from the keyboard.
- Using a pure password-based authentication scheme. Here, the plain text password is encrypted before sent over the network.

Several configuration options for authentication handling are available in ssh:connect/3,4 and ssh:daemon/2,3.

The public key handling can be customized by implementing the following behaviours from `ssh`:

- Module `ssh_client_key_api`.
- Module `ssh_server_key_api`.

### Connection Protocol

The SSH Connection Protocol provides application-support services over the transport pipe, for example, channel multiplexing, flow control, remote program execution, signal propagation, and connection forwarding. Functions for handling the SSH Connection Protocol can be found in the module `ssh_connection` in `ssh`.

### Channels

All terminal sessions, forwarded connections, and so on, are channels. Multiple channels are multiplexed into a single connection. All channels are flow-controlled. This means that no data is sent to a channel peer until a message is received to indicate that window space is available. The initial window size specifies how many bytes of channel data that can be sent to the channel peer without adjusting the window. Typically, an SSH client opens a channel, sends data (commands), receives data (control information), and then closes the channel. The `ssh_client_channel` behaviour handles generic parts of SSH channel management. This makes it easy to write your own SSH client/server processes that use flow-control and thus opens for more focus on the application logic.

Channels come in the following three flavors:

- Subsystem - Named services that can be run as part of an SSH server, such as SFTP (ssh_sftpd). No subsystems are enabled by default. The Erlang `ssh` daemon can be configured to run any Erlang-implemented SSH subsystem.
- Shell - Interactive shell. By default the Erlang daemon does not expose the Erlang shell. It can be enabled with option `{shell, {shell, start, []}}`. The shell can be customized by providing your own read-eval-print loop. You can also provide your own Command-Line Interface (CLI) implementation, but that is much more work.
- Exec - By default one-time remote execution of commands is disabled. See function `ssh_connection:exec/4` for more information.

## Where to Find More Information

For detailed information about the SSH protocol, refer to the following Request for Comments(RFCs):

- RFC 4250 - Protocol Assigned Numbers
- RFC 4251 - Protocol Architecture
- RFC 4252 - Authentication Protocol
- RFC 4253 - Transport Layer Protocol
- RFC 4254 - Connection Protocol
- RFC 4344 - Transport Layer Encryption Modes
- RFC 4716 - Public Key File Format

← Previous Page SSH Release Notes
Next Page → Examples