In this article, we will look at how SSH works, how it is used to communicate securely with remote computers, and how computers establish and configure a session.
What is ssh?
SSH is short for secure shell. This is the protocol that is most often used to control remote computers over a network.
How is an SSH session established?
SSH Connection
There are several steps you need to take in order to start an SSH session between computers.
- First you need to provide a secure way to exchange messages between computers, that is, to set up an encrypted channel.
- Next you need to check the integrity of the data sent by the client.
- After that, the authenticity of the client is verified.
After these three steps, we can safely communicate with the remote computer, share secret data, and also check whether the client has permission to access the host. Each of the sections below will describe these actions in more detail.
Configure an encrypted channel
All information sent using SSH is encrypted. Both parties must know and understand the encryption method.
To encrypt the transmitted data using symmetric encryption . The essence of this approach is that both computers have the same encryption key, which is called a “symmetric key”. Symmetric encryption works very well, but only as long as third parties do not have access to the key.
One computer can create a key and send as a message via the Internet. But the message will not be encrypted yet, so anyone who intercepts it can immediately decrypt all the following messages.
The solution to this problem is to use the Diffie-Hellman key exchange protocol. Both computers create their private and public keys. Together they form a pair of keys. Computers share their public keys with each other via the Internet. Using their private and foreign public keys, the parties can independently generate the same symmetric key.
Verification
The next step in the SSH session setup process is to verify that the data was not tampered with during the transfer and that the other computer really is who it claims to be.
For verification, use a hash function. This is a math function that accepts input and creates a fixed-size string.
An important feature of this function is that it is almost impossible to determine the input data, knowing only the result of its work.
After the client and host have generated their symmetric keys, the client uses the hash function to generate the HMAC, which means “message authentication code using hashing”. The client will send this HMAC to the server for verification.
The hash function uses:
- symmetric client key,
- package sequence number
- message content (encrypted).
When a host receives an HMAC, it can use the same hash function with these three components:
- own (identical to the client) symmetric key;
- package sequence number;
- encrypted message.
If the generated hash matches the HMAC received from the client, then we can be sure that the connected computer is a computer with a symmetric key, because only the host and the client know the symmetric key, and other computers do not.
The beauty of this approach is that we did not just verify the identity of the client and made sure that the data was not forged, but we did it without transmitting any secret information.
Authentication
Even if we use symmetric keys for secure communication, we do not know whether the connecting computer has permission to access the contents of the host. In order to verify this, it is necessary to authenticate.
Many use password authentication. The client sends an encrypted message containing a password to the host. The host decrypts it and looks up the password in the database to make sure the client has permission to access it. The use of a password for authentication is acceptable, but has its drawbacks, since it is necessary to store all passwords on the server.
More secure is certificate authentication. Having formed a certificate, the client once enters the password to access the server and sends him the open part of the certificate. Further password entry is not required. This approach is considered to be more secure than just using a password, since it does not imply keeping the user’s secret on the host.
Conclusion
SSH is an important tool used to remotely control other computers. It is secure because both computers can encrypt and decrypt messages using symmetric keys.
The post Basic principles of the SSH protocol appeared first on Creador.