Remote accessTCP 22 Encrypted
Port 22: SSH
Secure Shell
Encrypted remote command-line access, also used for secure file transfer (SFTP, SCP) and port forwarding.
How attackers abuse it
- Password brute forcing and credential stuffing against internet-facing servers.
- Stolen or unprotected private keys giving silent access.
- Port forwarding used to tunnel past firewalls.
How to defend it
- Key-based authentication; disable password and root login.
- MFA or certificates for privileged access, and rate limiting such as fail2ban.
- Restrict source addresses and monitor authentication logs.
Exam tip
SSH replaces Telnet, rlogin and FTP. It encrypts the whole session, not just the password.