SSH Architecture

@amitmund June 25, 2026

SSH Topcis

Level: Beginner → Advanced Foundation

Understanding SSH Architecture is critical because every advanced SSH topic (keys, tunneling, forwarding, certificates, multiplexing, debugging, security) depends on understanding how SSH is structured internally.

What is SSH Architecture?
High-Level SSH Architecture
SSH Client
SSH Server
sshd (SSH Daemon)
OpenSSH Components
SSH Protocol Layers
Transport Layer
Authentication Layer
Connection Layer
Channels
Internal Process Flow
Complete Connection Walkthrough
Architecture Diagrams
Commands
Code Examples
Real-World Examples
Production Examples
Common Mistakes
Troubleshooting
Security Notes
Interview Questions
Hands-On Labs
Exercises
Quiz

1. What is SSH Architecture?

SSH Architecture is the internal design of the SSH protocol.

It defines:

How communication begins

How encryption is established

How users authenticate

How data is transmitted

How multiple services share a connection

Without architecture:

No secure communication
No authentication
No shell session
No file transfer
No port forwarding

2. High-Level SSH Architecture

At the highest level:

+------------+
| SSH Client |
+------------+
       |
       |
Encrypted Communication
       |
       |
+------------+
| SSH Server |
+------------+

The client initiates.

The server responds.

Real Example

ssh [email protected]

Client:

Your laptop

Server:

Remote Linux machine

3. SSH Client

The SSH Client is the program used to initiate connections.

Most common client:

ssh

Location:

/usr/bin/ssh

Verify:

which ssh

Example:

ssh user@server

Client Responsibilities

The client:

Initiates connection

Negotiates algorithms

Verifies server identity

Authenticates user

Encrypts outgoing traffic

Decrypts incoming traffic

Client Workflow

User
 |
ssh command
 |
TCP Connection
 |
Verify Server
 |
Authenticate
 |
Open Session

Client Example

ssh [email protected]

Client actions:

1. Resolve hostname
2. Connect to server
3. Exchange protocol versions
4. Verify host key
5. Negotiate encryption
6. Authenticate
7. Open shell

4. SSH Server

The SSH Server accepts incoming SSH connections.

Its job:

Listen for connections

Verify users

Create sessions

Manage channels

Provide secure services

Server Diagram

SSH Client
     |
     |
Encrypted Channel
     |
     |
SSH Server

Server Responsibilities

Accept TCP connections

Present host key

Perform key exchange

Authenticate users

Create channels

Launch shells

Linux Server Example

Check if SSH server exists:

which sshd

Example:

/usr/sbin/sshd

5. sshd (SSH Daemon)

The server program is called:

sshd

Meaning:

SSH Daemon

A daemon is:

A background service
waiting for requests.

Verify sshd

ps aux | grep sshd

Example:

root     650  0.0  sshd

Check Status

Ubuntu:

sudo systemctl status ssh

Start Service

sudo systemctl start ssh

Restart Service

sudo systemctl restart ssh

sshd Responsibilities

Listen on Port 22

Present Host Keys

Authenticate Clients

Launch Sessions

Handle Channels

Manage Port Forwarding

sshd Configuration

File:

/etc/ssh/sshd_config

Example:

Port 22
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

6. OpenSSH Components

OpenSSH is the most widely used SSH implementation.

Package:

OpenSSH

Major Components

ssh
sshd
ssh-keygen
ssh-agent
ssh-add
scp
sftp
sftp-server
ssh-keyscan

Component Overview

Component	Purpose
ssh	Client
sshd	Server
ssh-keygen	Generate keys
ssh-agent	Store keys
ssh-add	Load keys
scp	File copy
sftp	File transfer
sftp-server	SFTP backend
ssh-keyscan	Collect host keys

Example

Generate key:

ssh-keygen

Copy file:

scp file.txt server:/tmp

7. SSH Protocol Layers

SSH is divided into layers.

Think:

Building
 ├── Floor 1
 ├── Floor 2
 └── Floor 3

SSH:

Transport Layer
Authentication Layer
Connection Layer

Layer Diagram

+-------------------+
| Connection Layer  |
+-------------------+
| Authentication    |
+-------------------+
| Transport Layer   |
+-------------------+
| TCP               |
+-------------------+

Why Layers Exist

Benefits:

Modularity

Security

Flexibility

Extensibility

8. Transport Layer

The Transport Layer is the foundation.

Responsibilities:

Encryption

Integrity

Compression

Key Exchange

Server Authentication

Transport Layer Flow

Client
   |
Version Exchange
   |
Algorithm Negotiation
   |
Key Exchange
   |
Encryption Enabled

What Happens Here?

Examples:

AES

ChaCha20

Curve25519

Diffie-Hellman

are negotiated here.

Transport Layer Goal

Create:

Secure Tunnel

between client and server.

Diagram

Client
   |
   | Secure Tunnel
   |
Server

9. Authentication Layer

After transport security exists:

User identity must be verified.

This is the Authentication Layer.

Supported Methods

Password

Public Key

Certificate

Keyboard Interactive

Authentication Flow

User
 |
Authentication Request
 |
Server Verification
 |
Success

Example

ssh user@server

Server asks:

Who are you?

Client proves identity.

Authentication Layer Purpose

Prevent unauthorized access.

10. Connection Layer

After authentication:

User gets access.

Connection Layer manages:

Shell Sessions

Port Forwarding

SFTP

SCP

Multiple Channels

Example

ssh user@server

Connection Layer creates:

Interactive Shell

Another Example

sftp user@server

Connection Layer creates:

SFTP Channel

Connection Layer Responsibilities

Channel Management

Session Creation

Forwarding

Subsystem Management

11. Channels

One SSH connection can contain multiple logical channels.

Think:

One Highway
Many Lanes

Diagram

SSH Connection
     |
     +---- Shell
     |
     +---- SFTP
     |
     +---- Port Forward
     |
     +---- Command Execution

Why Channels?

Without channels:

Need separate SSH connections
for every task.

Channels allow reuse.

Channel Types

Session Channel

Interactive shell.

ssh user@server

Exec Channel

Run command.

ssh server "uptime"

SFTP Channel

File transfer.

sftp user@server

Port Forward Channel

Tunnel traffic.

ssh -L

Real Example

One SSH connection:

Shell Session

File Transfer

Database Tunnel

simultaneously.

12. Internal Process Flow

Let's see everything together.

Step 1

User runs:

ssh user@server

Step 2

Client resolves hostname.

DNS Lookup

Step 3

TCP connection created.

Port 22

Step 4

Version exchange.

SSH-2.0

Step 5

Algorithm negotiation.

AES
ChaCha20
Curve25519

Step 6

Key exchange.

Secure session key generated.

Step 7

Encrypted tunnel established.

Step 8

Server presents host key.

Step 9

User authentication.

Password

Public Key

Step 10

Connection layer activated.

Step 11

Channels created.

Shell
SFTP
Forwarding

Step 12

User receives shell.

user@server:~$

13. Complete Connection Walkthrough

User
 |
ssh user@server
 |
Client
 |
DNS
 |
TCP
 |
Version Exchange
 |
Key Exchange
 |
Encryption
 |
Host Verification
 |
Authentication
 |
Channel Creation
 |
Shell

14. Architecture Diagram

+--------------------------------+
|        SSH Connection          |
+--------------------------------+
               |
       +-------+-------+
       |               |
 Transport Layer
       |
 Encryption
 Integrity
 Key Exchange
       |
 Authentication Layer
       |
 Password
 Public Key
 Certificate
       |
 Connection Layer
       |
 +------+-------+------+
 |      |       |      |
Shell SFTP Exec Tunnel

15. Commands

Check SSH version:

ssh -V

Check server:

which sshd

Check daemon:

ps aux | grep sshd

Check port:

ss -tlnp | grep ssh

Verbose mode:

ssh -vvv user@server

16. Code Examples

Execute command:

ssh user@server "uptime"

Open shell:

ssh user@server

File transfer:

scp file.txt user@server:/tmp

SFTP:

sftp user@server

17. Real-World Examples

System administrator:

Connect to Linux server

Inspect logs

Restart services

Manage users

All through SSH architecture.

18. Production Examples

Cloud Infrastructure:

Laptop
   |
SSH
   |
AWS EC2

Deployment Pipeline:

GitHub Actions
      |
      SSH
      |
Production Server

Database Access:

Developer
   |
SSH Tunnel
   |
Private Database

19. Common Mistakes

Mistake 1

Confusing:

ssh

with

sshd

Mistake 2

Thinking SSH is only a shell.

Actually SSH supports:

Shell

File Transfer

Tunneling

Forwarding

Automation

Mistake 3

Ignoring protocol layers.

Layers explain:

Where failures occur.

Mistake 4

Not understanding channels.

Many SSH features rely on channels.

20. Troubleshooting

sshd Not Running

Check:

sudo systemctl status ssh

Port Closed

Check:

ss -tlnp

Authentication Failure

Check:

ssh -vvv user@server

Host Verification Problems

Check:

~/.ssh/known_hosts

21. Security Notes

Always:

Verify Host Keys

Prefer:

Public Key Authentication

Keep:

OpenSSH Updated

Disable:

Root Login

where possible.

22. Interview Questions

Q1:

What are the three SSH protocol layers?

Answer:

Transport Layer
Authentication Layer
Connection Layer

Q2:

What is sshd?

Answer:

SSH daemon running on server.

Q3:

What is a channel?

Answer:

Logical communication stream
inside an SSH connection.

Q4:

Which layer performs encryption?

Answer:

Transport Layer

Q5:

Which layer creates shell sessions?

Answer:

Connection Layer

23. Hands-On Labs

Lab 1

Locate SSH Client

which ssh

Lab 2

Locate SSH Server

which sshd

Lab 3

Inspect Running Daemon

ps aux | grep sshd

Lab 4

Observe Verbose Connection

ssh -vvv user@server

Watch:

Version Exchange

Key Exchange

Authentication

Lab 5

Open Multiple Channels

Terminal 1:

ssh user@server

Terminal 2:

sftp user@server

Observe different channel types.

24. Exercises

Exercise 1:

Draw the SSH architecture diagram.

Exercise 2:

Explain the role of sshd.

Exercise 3:

List all major OpenSSH components.

Exercise 4:

Describe Transport Layer responsibilities.

Exercise 5:

Explain how channels work.

25. Quiz

Question 1

SSH has how many protocol layers?

A. 2
B. 3
C. 4
D. 5

Answer:

Question 2

Which process listens for SSH connections?

A. ssh
B. ssh-agent
C. sshd
D. scp

Answer:

Question 3

Which layer handles encryption?

A. Authentication
B. Connection
C. Transport
D. Session

Answer:

Question 4

Which layer manages shell sessions?

A. Connection
B. Authentication
C. TCP
D. DNS

Answer:

Question 5

What is a channel?

A logical communication stream
inside an SSH connection.

Summary

You should now understand:

✓ SSH Client

✓ SSH Server

✓ sshd

✓ OpenSSH Components

✓ Transport Layer

✓ Authentication Layer

✓ Connection Layer

✓ Channels

✓ Internal Process Flow

✓ Complete SSH Architecture

Next Topic:

Topic #3 — Installing SSH

OpenSSH Installation
Client vs Server Packages
Linux
Windows
macOS
Systemd Services
SSH Configuration Files
Verification and Testing

SSH Topcis

Table of Contents

1. What is SSH Architecture?

2. High-Level SSH Architecture

Real Example

3. SSH Client

Client Responsibilities

Client Workflow

Client Example

4. SSH Server

Server Diagram

Server Responsibilities

Linux Server Example

5. sshd (SSH Daemon)

Verify sshd

Check Status

Start Service

Restart Service

sshd Responsibilities

sshd Configuration

6. OpenSSH Components

Major Components

Component Overview

Example

7. SSH Protocol Layers

Layer Diagram

Why Layers Exist

8. Transport Layer

Transport Layer Flow

What Happens Here?

Transport Layer Goal

Diagram

9. Authentication Layer

Supported Methods

Authentication Flow

Example

Authentication Layer Purpose

10. Connection Layer

Example

Another Example

Connection Layer Responsibilities

11. Channels

Diagram

Why Channels?

Channel Types

Session Channel

Exec Channel

SFTP Channel

Port Forward Channel

Real Example

12. Internal Process Flow

Step 1

Step 2

Step 3

Step 4

Step 5

Step 6

Step 7

Step 8

Step 9

Step 10

Step 11

Step 12

13. Complete Connection Walkthrough

14. Architecture Diagram

15. Commands

16. Code Examples

17. Real-World Examples

18. Production Examples

19. Common Mistakes

Mistake 1

Mistake 2

Mistake 3

Mistake 4

20. Troubleshooting

sshd Not Running

Port Closed

Authentication Failure

Host Verification Problems

21. Security Notes