SSH2

SSH-2, or Secure Shell version 2, is the second major version of the Secure Shell protocol. It provides a secure channel over an unsecured network for remote login and other secure network services, replacing SSH-1 due to security weaknesses and limited feature support.

SSH-2 is organized into three layers: the transport layer, the authentication protocol, and the connection protocol. The transport layer handles encryption, integrity checks through MACs, and the key exchange that establishes a session key. The authentication protocol negotiates user or host authentication, offering methods such as public key, password, or keyboard-interactive. The connection protocol manages multiplexed channels for sessions and subsystems, including the SSH File Transfer Protocol (SFTP).

Security features in SSH-2 include support for strong encryption algorithms (for example, AES and ChaCha20), integrity protection via MACs or authenticated encryption, and public-key authentication using RSA, DSA (legacy), ECDSA, and Ed25519. Key exchange mechanisms such as Diffie-Hellman and Elliptic Curve Diffie-Hellman provide forward secrecy. Password and keyboard-interactive methods offer flexible authentication options.

Common uses of SSH-2 include remote shell access, secure file transfer via SFTP, and tunneling or port forwarding. SFTP is a standard subsystem for file access over SSH-2.

Implementation and standards: SSH-2 implementations include OpenSSH, PuTTY, libssh, and various commercial clients. The protocol is standardized by the IETF in a set of RFCs commonly cited as RFC 4250–4254 and related documents.

Interoperability: SSH-2 is widely supported across operating systems, with clients and servers negotiating the best mutually supported algorithms to establish a secure session.