---
title: "What Is SSH and How Do You Connect to a Server?"
description: "SSH (Secure Shell) is the encrypted way to log into a server and run commands on it, by default on port 22. How it works, how to connect and how SSH keys work."
url: https://proxynet.io/blog/what-is-ssh
date: 2026-11-15
author: "Acar Diveroli"
category: "Tutorial, Proxies"
lang: en
---

# What Is SSH and How Do You Connect to a Server?

You rent a small cloud server, and the welcome email holds three things: an IP address, a user name and the line "SSH port: 22". Or the manual of a storage box on your home network tells you to open a terminal and type `ssh admin@192.168.1.50`. Both expect the same thing: log into that machine over SSH and work on its command line as if you sat in front of it.

This post explains what SSH is, what happens when you connect and how to connect from Windows, macOS and Linux. Then come the host key question, SSH keys versus passwords, tunnels, SSH versus TLS and a VPN, and when SSH can stand in for a proxy.

> **Note: Short answer**
>
> SSH (Secure Shell) is a protocol for logging into another computer and running commands on it over an encrypted connection. You run an SSH client such as the `ssh` command, which is built into Windows 10 and 11, macOS and Linux, and connect to an SSH server, by default on TCP port 22: `ssh user@server.example`. The server proves its identity with a host key, you prove yours with a password or, better, an SSH key, and everything after that travels encrypted.

## What is SSH?

SSH, short for Secure Shell, is a network protocol that gives you a command line on a remote computer over an encrypted connection. A **shell** is the program that reads the commands you type and runs them, such as Bash on Linux or PowerShell on Windows; SSH carries that conversation across the network so nobody in between can read or change it.

Two programs take part. The **SSH client** runs on your computer and starts the connection; the **SSH server**, a background program usually called `sshd`, runs on the remote machine and listens on TCP port 22 by default. [RFC 4251](https://www.rfc-editor.org/rfc/rfc4251), the architecture document of the current protocol version, calls SSH a protocol "for secure remote login and other secure network services over an insecure network".

The same encrypted connection can also copy files, run a single command or carry other network connections, which is what an SSH tunnel does. Older tools such as Telnet send everything, passwords included, as readable text; SSH does the same job encrypted.

## How does an SSH connection work?

An SSH connection is set up in a fixed order: the two sides agree on encryption, the server proves who it is, and only then do you log in. This is what happens after `ssh user@server.example`:

1. **TCP connection.** Your client connects to the server, on port 22 unless you name another one.
2. **Version exchange.** Each side sends a line that starts with `SSH-2.0-` and names its software.
3. **Key exchange.** Both sides list the algorithms they support, pick common ones and compute the same secret without ever sending it. The session keys that encrypt everything from here on come from that secret.
4. **Server authentication.** The server signs the result with its private **host key**. Your client checks the signature and compares the key with the one it saved before, or asks you if the server is new.
5. **User authentication.** You log in inside the encrypted connection, with a password or by proving that you hold an SSH key.
6. **Channels.** Your shell, file transfers and forwarded ports run as separate channels inside that one connection.

[RFC 4253](https://www.rfc-editor.org/rfc/rfc4253), the transport layer specification, defines steps 1 to 4 and records port 22 as the port assigned to SSH. Because every connection gets fresh session keys, someone who records your traffic today and steals the server's host key later still cannot decrypt the recording.

## How do you connect to a server with SSH?

You type `ssh`, the user name on the server, an `@` sign and the server's address, then log in when asked:

```bash
ssh user@server.example
```

`user` is the account on the server, not on your computer, and `server.example` stands for a host name or an IP address such as `203.0.113.10`. For a port other than 22, add `-p`: `ssh -p 2222 user@server.example`. After the host key question described below comes the password; nothing appears on screen while you type it. Once the prompt changes to something like `user@server:~$`, your commands run on the server, and `exit` takes you back.

### On Windows

Windows 10 (from build 1809) and Windows 11 include an OpenSSH client, so `ssh` works in PowerShell, Command Prompt and Windows Terminal. To check, run `ssh -V`. On our Windows 11 test machine it printed:

```text
OpenSSH_for_Windows_9.5p2, LibreSSL 3.8.2
```

If `ssh` is not recognized, open Settings > System > Optional features, select **View features**, search for **OpenSSH Client** and add it; on some Windows 11 versions the page sits under Settings > Apps. Microsoft's guide [Get started with OpenSSH for Windows](https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse) shows these steps and a first connection.

### On macOS and Linux

Both ship an SSH client. On a Mac, open Terminal through Spotlight or from Applications > Utilities and type the same command. If a Linux system lacks `ssh`, install its OpenSSH client package, usually named `openssh-client` or `openssh`.

## Why does SSH ask "Are you sure you want to continue connecting"?

SSH asks because it has never seen this server's host key and cannot tell on its own whether the key belongs to the server you meant to reach. A **host key** is a key pair the server creates when SSH is set up on it; its public half identifies the server, much as a certificate identifies a website.

OpenSSH prints "The authenticity of host … can't be established", shows the key's type and **fingerprint**, a short checksum such as `SHA256:` plus 43 characters, and asks "Are you sure you want to continue connecting (yes/no/[fingerprint])?". If you answer `yes`, the client saves the key in the `known_hosts` file in the `.ssh` folder of your user profile and checks it on every later connection.

Before you answer, compare the fingerprint with one you got another way: some cloud providers show it in the server's console output, and an administrator can print it on the server with `ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub`. Accepting a key unchecked leaves you open to a man-in-the-middle attack, where someone between you and the server poses as the server and reads your password.

If a known server suddenly shows "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!", stop and ask whoever runs it before you remove the old entry; a reinstalled server is harmless, an impostor is not. Never silence the question with `StrictHostKeyChecking no`: it removes the one check that tells you who is on the other end.

## How do you create an SSH key?

You create an SSH key pair with `ssh-keygen`, which comes with the SSH client:

```bash
ssh-keygen -t ed25519 -C "you@laptop"
```

`-t ed25519` picks the Ed25519 type, already the default in current OpenSSH, and `-C` adds a comment to recognise the key. The command asks where to save the key (Enter accepts the `.ssh` folder in your user profile) and for a **passphrase**, a password that encrypts the private key file. Set one: without it, anyone who copies the file can log in as you.

On our Windows 11 test machine we saved a throwaway key into a test folder with `-f demo_ed25519` and deleted it afterwards. The output, folder path removed:

```text
Generating public/private ed25519 key pair.
Your identification has been saved in demo_ed25519
Your public key has been saved in demo_ed25519.pub
The key fingerprint is:
SHA256:lkosA9+FmCGq1dOjgIoIqQKwHR/jAMjzf+GsngbbGCc you@laptop
```

The file without an extension is the **private key**: it never leaves your computer. The `.pub` file is the **public key**, a single line you can share freely. The [ssh-keygen manual](https://man.openbsd.org/ssh-keygen) lists every option, including how to change a passphrase.

For key login, the public key line goes into `~/.ssh/authorized_keys` of your account on the server. Many cloud providers ask for it when you create a server and place it there. On macOS and Linux, `ssh-copy-id user@server.example` copies it after one password login; on Windows, open the `.pub` file in Notepad, copy the line, log in once with your password and paste it into that file.

## Password or SSH key: which login should you use?

Use an SSH key wherever you can: a password is fine for the first login, but a key is safer and easier once it is in place.

| | Password login | SSH key login |
|---|---|---|
| What you need | The account password | The private key file and its passphrase |
| What reaches the server | The password, inside the encryption | Only a signature; the key stays home |
| Guessing attacks | Possible against weak passwords | Not practical |
| Password reused from a leaked site | Opens the server | No effect |
| Scripts and automatic backups | Awkward and risky | Built for it |
| If you lose it | An admin resets it | Add a new public key through the console |

The RFC that defines SSH logins makes key login the only method every server must support; passwords are optional.

## What is an SSH tunnel?

An SSH tunnel carries another network connection inside your encrypted SSH session, so a program on your computer can reach a service on or near the server as if it were local. This is called **port forwarding**, and `ssh` offers three kinds.

**Local forwarding (`-L`)** is the common one. If your server runs a database that listens only on its own `127.0.0.1`, then with `ssh -L 5432:localhost:5432 user@server.example` a database tool on your laptop connects to `localhost:5432` and SSH delivers it to the database on the server. **Remote forwarding (`-R`)** opens a port on the server that leads back to your computer. **Dynamic forwarding (`-D`)** turns the client into a small SOCKS proxy, covered next.

The [OpenSSH manual for ssh](https://man.openbsd.org/ssh) describes each option. Use tunnels only on servers you own or administer and on networks where you are allowed to. A tunnel hides its contents from the local network but does not make them permitted: if a school, an employer or an authority blocks a service, carrying it through SSH still breaks those rules.

## Can SSH work as a SOCKS5 proxy?

Yes: `ssh -D 1080 -N user@server.example` starts a SOCKS5 proxy on port 1080 of your own computer and sends what goes into it out through your server; `-N` opens no shell, only the tunnel. A **SOCKS5 proxy** relays a program's connections to any address and port without reading them, as explained in [What Is a SOCKS5 Proxy?](/blog/socks5-proxy-101)

Set a browser to the SOCKS5 proxy `127.0.0.1` port 1080, and websites see your server's IP instead of your home connection. Command-line tools usually take their proxy from environment variables, which work as described in [Linux proxy settings](/blog/linux-proxy-settings).

That helps with your own work, such as checking your site from the server's location. The limits come with it: one exit IP, a datacenter address in one city, a server you maintain yourself, and TCP only, while a SOCKS5 proxy can also carry UDP.

When a task needs more than one address, our [SOCKS5 Proxy](https://proxynet.io/socks5-proxy) service works with the same settings in the same programs and offers residential and mobile IPs in many countries, targeted by country and city.

For a fixed address, [Datacenter Proxy](https://proxynet.io/datacenter-proxy) gives you dedicated IPv4 addresses in more than 50 countries without running a server.

## SSH vs SSL/TLS vs VPN: what is the difference?

All three encrypt traffic, but they protect different things: SSH protects a login and the connections opened through it, TLS protects one application connection such as a web page, and a VPN protects everything a device sends.

| | SSH | SSL/TLS | VPN |
|---|---|---|---|
| What it protects | Your session on one server | One connection, such as HTTPS | All traffic of the device |
| How the server is checked | Host key, saved on first use | Certificate signed by an authority | Depends on the VPN protocol |
| Typical use | Server administration, file transfer | Websites, email, APIs | Office network, public Wi-Fi |
| Default port | 22 | 443 for HTTPS | Depends on the protocol |

The practical difference is how trust starts. A browser trusts a website because a certificate authority vouched for its [SSL certificate](/blog/what-is-an-ssl-certificate), while SSH trusts the key you accepted on the first connection, which is why that fingerprint check matters.

## How do you keep SSH access to your server safe?

SSH is safe when you check host keys, log in with keys and keep the server updated; break-ins come from weak passwords and stolen keys, not from the protocol. Assume that someone is always trying to log in:

- **Use keys with a passphrase,** one key per person, so you can remove one without touching the others.
- **Turn off password logins once your key works:** `PasswordAuthentication no` in `/etc/ssh/sshd_config` on your own Linux server. Keep one session open while you test, so a mistake cannot lock you out.
- **Do not log in as root with a password.** OpenSSH's default already allows root only with keys; use a normal account and `sudo`.
- **Install updates** for the operating system and the SSH server.
- **Guard the private key** like a password: never paste it into a chat, a ticket or a repository.

Moving SSH to another port only cuts the noise in the logs; the protection comes from keys and updates.

## Where you meet SSH

- **Cloud servers and VPS plans,** usually managed over SSH from the first day.
- **Shared hosting,** where many plans offer SSH next to the file manager.
- **Git,** where addresses such as `git@host:team/project.git` push and pull code with your key.
- **File transfer** with `scp` and `sftp`, which run over SSH and come with Windows too.
- **Home devices** such as network storage and routers.
- **Your own Mac,** which other computers can reach over SSH once Remote Login in System Settings > General > Sharing is on; Apple notes this can make the Mac less secure.

## Common mistakes

- **Typing `yes` at the first-connection question without comparing the fingerprint.**
- **Silencing host key warnings** with `StrictHostKeyChecking no` instead of finding out why the key changed.
- **Sending the private key** instead of the `.pub` file when someone asks for "your SSH key".
- **Turning off password logins before key login works,** then losing access to the server.
- **Using the wrong user name.** Many cloud images use an account such as `ubuntu` or `admin` instead of `root`, and a wrong name ends in "Permission denied".
- **Expecting proxy environment variables to affect `ssh`.** They do not; SSH has its own settings in `~/.ssh/config`.

## Decision guide

| Your need | What to do |
|---|---|
| Log into a server for the first time | `ssh user@server.example`, compare the fingerprint, then answer `yes` |
| Server uses another port | Add `-p` and the port number |
| Stop typing passwords | Create a key with `ssh-keygen`, add the `.pub` line to `authorized_keys` |
| Reach a database that listens only on the server | Local forwarding with `-L` |
| Browse through your own server's IP | `ssh -D 1080 -N`, then SOCKS5 `127.0.0.1:1080` |
| Many locations or residential IPs | A proxy service instead of one server |

## Frequently asked questions

### Is SSH secure?

Yes, if you check the host key on the first connection and protect your login. The weak points are guessable passwords, keys without a passphrase and fingerprints accepted unchecked, not the encryption.

### What is port 22?

Port 22 is the TCP port SSH servers listen on by default, officially assigned to SSH. A server can use another port; then you connect with `ssh -p 2222 user@server.example` or save it in `~/.ssh/config` with a `Port` line.

### Can I use SSH on my phone?

Yes. SSH client apps for Android and iPhone connect with the same address, user name and port, and most can create a key on the phone whose public half you add to the server. Compare the host key fingerprint there too.

### What does "Permission denied (publickey)" mean?

The server accepts only key logins, and none of the keys your client offered is listed for that user. Check the user name, whether the right key is used (`ssh -i` picks one), and whether its `.pub` line is in `~/.ssh/authorized_keys` of that account.

### What is the difference between SSH, SFTP and SCP?

SSH is the protocol and the remote login; SFTP and SCP are file transfer tools that run inside an SSH connection. `sftp` opens a session where you browse folders, `scp` copies files in one command, and both use the same login and keys as `ssh`.

### How do I end an SSH session?

Type `exit`, or press Ctrl+D when the server runs Linux or macOS. If the session hangs, press Enter, then type `~.` (tilde and dot): the client treats this as an escape sequence and closes the connection from your side.

## Summary

SSH gives you an encrypted command line on a remote computer: your client connects on port 22, the server proves itself with a host key, and you log in with a password or, better, a key from `ssh-keygen`. Check the fingerprint once, never turn host key checking off, and tunnel only where you are allowed to. When you need more exit addresses than one server gives, compare our [proxy products](/proxy).