What is SSH? A plain-English explainer
SSH (Secure Shell) is a protocol for securely connecting to and running commands on a remote computer over a network you do not fully trust, such as the open internet. It is the standard way administrators and developers log in to and manage cloud servers, giving you an encrypted terminal session on a machine that might be sitting in a data centre on the other side of the world.
What SSH actually does
At its core, SSH opens an encrypted channel between your computer and a remote one, and lets you run commands on that remote machine as if you were sitting in front of it — a remote terminal, in effect. Everything sent over that channel, including anything you type and anything the remote machine sends back, is encrypted, so it cannot be read or tampered with by anyone intercepting the traffic in between. SSH can also carry file transfers and even forward other traffic through the same encrypted tunnel, but the remote terminal is its most common use.
Key-based vs password authentication
SSH supports logging in with a password, but key-based authentication is strongly preferred in practice, and cloud providers generally default new servers to it. The idea is a key pair: a private key that never leaves your own computer, and a matching public key that you place on the server you want to access. When you connect, the server and your computer use a cryptographic exchange to prove you hold the matching private key, without that private key ever being transmitted. This is more resistant to the kinds of attacks that target passwords — guessing, reuse, interception — because there is no password travelling over the network to steal in the first place, and a private key is typically far harder to guess than a password.
The public/private key idea, briefly
A key pair is two mathematically related files: whatever is encrypted or signed with one can only be verified or decrypted by the other. The public key is safe to share and place on any server you want to access — its whole purpose is to be public. The private key must stay secret and stays only on your own machine. Because of that relationship, a server holding your public key can confirm a connection really is coming from someone holding the matching private key, without the private key itself ever needing to be sent anywhere.
SSH in a cloud context
When you launch a Linux virtual machine in the cloud — an Amazon EC2 instance, for example — SSH is typically the way you first connect to it to configure it, install software, or troubleshoot. Rather than opening every server directly to the internet, many architectures route SSH access through a bastion host: a single, carefully controlled entry point that you connect to first, which then lets you reach other servers on a private network. Our what is a bastion host explainer covers that pattern in more depth. SSH runs over a specific, well-known network port by convention, though the exact port a given server listens on can be configured differently.
Why it matters beyond just “logging in”
SSH is not just a login mechanism — because the whole session is encrypted, it is also a foundation piece of secure remote administration generally, including securely copying files and even securely tunnelling other applications’ traffic between machines. Our what is encryption in the cloud explainer covers the broader idea of protecting data in transit, which is exactly the property SSH is providing for terminal access. Any time you see instructions to “SSH into” a cloud server, they are describing this same encrypted-remote-access pattern.
Original practice questions, timed mock exams and revision notes. No card, nothing to pay.
Questions, answered
Sources
Exam details in this post come from the vendor's published exam guide, which is the authority on what is tested and how.
- AWS Certified Solutions Architect – Associate (SAA-C03) exam guide — Amazon Web Services
- AWS Certified Cloud Practitioner (CLF-C02) exam guide — Amazon Web Services