What is SSH?

Secure Shell is the standard protocol for administering Unix-like systems remotely, and also underpins SFTP file transfer, port forwarding and Git over SSH. It listens on TCP port 22 by default and provides an encrypted channel with mutual verification: the client authenticates to the server, and the server presents a host key the client is expected to check.

Exposure is normal, weak configuration is not

Unlike RDP, SMB or a database port, SSH on the internet is a defensible design if configured well. The protocol is sound and the software is widely reviewed, so the findings that matter are configuration and version:

• Password authentication enabled — invites automated guessing; key-based authentication removes the class of attack
• Root login permitted — contradicts least privilege and removes the audit trail of who escalated
• Obsolete algorithms — old ciphers, MACs and key exchange methods left enabled for compatibility
• Outdated server version — SSH implementations do carry occasional serious CVEs, and the version is usually visible through banner grabbing

Automated password guessing against port 22 is constant background noise on any public host, so brute-force attempts in the logs are expected rather than evidence of a targeted attack — but they succeed whenever a weak password is left reachable.

Practical hardening

Prefer keys over passwords, disable direct root login, restrict source addresses where the client population is known, and keep the server patched. Moving off port 22 reduces log volume rather than risk, since port scanning finds the service anyway. Host keys deserve attention too: a host key changing unexpectedly is worth investigating, and reusing one key across many hosts weakens the verification it exists to provide.

Related concepts

Compare telnet, the unencrypted predecessor SSH replaced, and FTP, where SFTP or FTPS is the analogous upgrade. A VPN gateway is the usual alternative to exposing administrative services directly.