SSH Learning

SSH Connection Lifecycle

Topic

Level: Beginner → Advanced Foundation

Every time you run:
ssh user@server
a complex sequence of events occurs behind the scenes.

Understanding the SSH Connection Lifecycle is one of the most important concepts in SSH because it explains:

How a connection starts

How trust is established

How encryption is created

How authentication works

How sessions and channels are built

What is the SSH Connection Lifecycle?
Complete Lifecycle Overview
DNS Resolution
TCP Handshake
Protocol Version Exchange
Algorithm Negotiation
Host Verification
Key Exchange
Encryption Setup
Authentication
Session Creation
Channel Creation
Interactive Shell
Full Packet Flow
Lifecycle Diagrams
Commands
Code Examples
Real-World Examples
Production Examples
Common Mistakes
Troubleshooting
Security Notes
Interview Questions
Hands-On Labs
Exercises
Quiz

1. What is the SSH Connection Lifecycle?

The SSH Connection Lifecycle is the complete sequence of events that occur from:

ssh user@server

until:

user@server:~$

appears.

Why It Matters

Understanding the lifecycle helps you:

Understand SSH Internals

Debug Connection Problems

Analyze Security Issues

Read SSH Logs

Interpret Verbose Output

Understand Packet Captures

High-Level Lifecycle

DNS Resolution
       |
TCP Handshake
       |
Version Exchange
       |
Algorithm Negotiation
       |
Host Verification
       |
Key Exchange
       |
Encryption Setup
       |
Authentication
       |
Session Creation
       |
Channel Creation
       |
Interactive Shell

2. Complete Lifecycle Overview

Example command:

ssh [email protected]

Behind the scenes:

1. Resolve hostname
2. Create TCP connection
3. Exchange SSH versions
4. Negotiate algorithms
5. Verify server identity
6. Exchange keys
7. Create encrypted tunnel
8. Authenticate user
9. Create session
10. Create channel
11. Launch shell

Master Flow Diagram

User
 |
ssh user@server
 |
DNS Resolution
 |
TCP Handshake
 |
Version Exchange
 |
Algorithm Negotiation
 |
Host Verification
 |
Key Exchange
 |
Encryption Enabled
 |
Authentication
 |
Session Creation
 |
Channel Creation
 |
Interactive Shell

3. DNS Resolution

Before connecting, the client must find the server's IP address.

Example

Command:

ssh [email protected]

SSH asks:

What IP address belongs to
server.example.com?

DNS Lookup

Client
   |
DNS Query
   |
DNS Server
   |
IP Address Returned

Example Result

server.example.com
      |
      |
203.0.113.10

Verification

Check manually:

nslookup server.example.com

dig server.example.com

Failure Example

Could not resolve hostname

Cause:

DNS Failure
Typo
Network Issue

4. TCP Handshake

SSH uses TCP.

Default port:

Purpose

Create a reliable communication channel.

Three-Way Handshake

Client                     Server

SYN -------------------->

     <------------------- SYN-ACK

ACK -------------------->

Result

TCP connection established.

Verify

ss -tn

Failure Example

Connection refused

Possible causes:

sshd not running

Port closed

Firewall blocking

5. Protocol Version Exchange

After TCP is established:

Client and server exchange SSH versions.

Example

Client:

SSH-2.0-OpenSSH_9.8

Server:

SSH-2.0-OpenSSH_9.3

Why?

Ensures:

Compatible Protocols

Compatible Features

Packet View

Client
   |
SSH-2.0-OpenSSH_9.8
   |
Server
   |
SSH-2.0-OpenSSH_9.3

Failure Example

Rare:

Protocol mismatch

6. Algorithm Negotiation

Now both sides decide which cryptographic algorithms to use.

Why?

Client and server support different algorithms.

Need common choices.

Negotiated Categories

Key Exchange

Host Key Algorithm

Encryption Cipher

MAC Algorithm

Compression

Example

Client Supports:

AES256
AES128
ChaCha20

Server Supports:

AES256
ChaCha20

Chosen:

AES256

Negotiation Diagram

Client
 |
Supported Algorithms
 |
Server
 |
Common Match Found
 |
Selected

Verify

ssh -Q cipher

Example Output

aes128-ctr
aes256-ctr
chacha20-poly1305

7. Host Verification

The client must verify:

Is this really the server?

Why?

Prevent:

Man-in-the-Middle Attacks

Server Presents

Host Key

First Connection

Example:

The authenticity of host
cannot be established.

Are you sure?

known_hosts

Stored in:

~/.ssh/known_hosts

Verification Flow

Server
 |
Host Key
 |
Client
 |
Compare with known_hosts
 |
Match?
 |
Yes → Continue
No  → Warning

Warning Example

REMOTE HOST IDENTIFICATION HAS CHANGED

Possible:

Server Reinstalled

Host Key Rotated

MITM Attack

8. Key Exchange

One of the most important stages.

Goal

Create:

Shared Secret

without sending it directly.

Common Algorithms

Curve25519

ECDH

Diffie-Hellman

Simplified Flow

Client Secret
       +
Server Secret
       =
Shared Secret

Important

The shared secret:

Never travels across network.

Diagram

Client
   |
Public Values
   |
Server
   |
Shared Secret Generated

Result

Both sides now have:

Same Secret Key

9. Encryption Setup

Using the shared secret:

Session keys are generated.

Purpose

Encrypt all future traffic.

Common Ciphers

AES128

AES256

ChaCha20

Before Encryption

username=admin

password=secret

Visible.

After Encryption

a9d92j39dk2kdj
29dj29dkkd29d
kdk2kkdk2kdk

Unreadable.

Encryption Diagram

Client
 |
Encrypt Data
 |
Encrypted Tunnel
 |
Decrypt Data
 |
Server

10. Authentication

Now server asks:

Who are you?

Authentication Methods

Password

Public Key

Certificate

Keyboard Interactive

Password Authentication

ssh user@server

Prompt:

Password:

Public Key Authentication

Client proves ownership of:

Private Key

without sending it.

Authentication Flow

Client
 |
Authentication Request
 |
Server
 |
Verification
 |
Success

Failure Example

Permission denied

11. Session Creation

Authentication succeeded.

Server creates a session.

What Is a Session?

Logical environment for user interaction.

Contains:

User Identity

Environment Variables

Permissions

Processes

Example

john@server:~$

This is your session.

Session Diagram

Authenticated User
        |
Session Created
        |
Shell Started

12. Channel Creation

SSH supports multiple channels.

One TCP connection.

Multiple logical streams.

Why?

Allows:

Shell

SFTP

Port Forwarding

Remote Commands

simultaneously.

Diagram

SSH Connection
      |
      +--- Shell Channel
      |
      +--- SFTP Channel
      |
      +--- Tunnel Channel

Channel Types

Session Channel

Interactive shell.

Exec Channel

Remote command execution.

Example:

ssh server "uptime"

SFTP Channel

File transfer.

Forwarding Channel

Port forwarding.

13. Interactive Shell

Final stage.

User Receives

user@server:~$

What Happens?

Server launches:

bash

zsh

sh

fish

depending on configuration.

Example

ssh user@server

Result:

user@server:~$

User Can Now

Run Commands

Edit Files

Manage Services

Transfer Files

Administer System

14. Full Packet Flow

Client
 |
DNS
 |
TCP Handshake
 |
Version Exchange
 |
Algorithm Negotiation
 |
Host Verification
 |
Key Exchange
 |
Encryption Setup
 |
Authentication
 |
Session Creation
 |
Channel Creation
 |
Interactive Shell

15. Lifecycle Diagram

+-----------------------+
| SSH Command Executed  |
+-----------------------+
            |
            v
+-----------------------+
| DNS Resolution        |
+-----------------------+
            |
            v
+-----------------------+
| TCP Handshake         |
+-----------------------+
            |
            v
+-----------------------+
| Version Exchange      |
+-----------------------+
            |
            v
+-----------------------+
| Algorithm Selection   |
+-----------------------+
            |
            v
+-----------------------+
| Host Verification     |
+-----------------------+
            |
            v
+-----------------------+
| Key Exchange          |
+-----------------------+
            |
            v
+-----------------------+
| Encryption Enabled    |
+-----------------------+
            |
            v
+-----------------------+
| Authentication        |
+-----------------------+
            |
            v
+-----------------------+
| Session Creation      |
+-----------------------+
            |
            v
+-----------------------+
| Channel Creation      |
+-----------------------+
            |
            v
+-----------------------+
| Interactive Shell     |
+-----------------------+

16. Commands

Connect:

ssh user@server

Verbose:

ssh -v user@server

Very Verbose:

ssh -vvv user@server

List Ciphers:

ssh -Q cipher

List Key Exchange Algorithms:

ssh -Q kex

Check Known Hosts:

cat ~/.ssh/known_hosts

17. Code Examples

Execute remote command:

ssh server "uptime"

Show kernel version:

ssh server "uname -r"

Show hostname:

ssh server "hostname"

Verbose connection:

ssh -vvv user@server

18. Real-World Examples

Linux Administrator:

Laptop
   |
SSH
   |
Remote Server

Lifecycle occurs every connection.

Developer:

git clone [email protected]:user/repo.git

SSH lifecycle runs behind the scenes.

19. Production Examples

AWS EC2:

ssh ubuntu@ec2-ip

Kubernetes Node:

ssh admin@worker-node

CI/CD Deployment:

GitHub Actions
      |
      SSH
      |
Production Server

20. Common Mistakes

Mistake 1

Ignoring host key warnings.

Mistake 2

Thinking encryption starts immediately.

Actually:

Key Exchange happens first.

Mistake 3

Confusing:

Authentication

Authorization

Mistake 4

Assuming one channel equals one connection.

Mistake 5

Ignoring verbose logs.

21. Troubleshooting

DNS Failure

Could not resolve hostname

Check:

dig hostname

TCP Failure

Connection refused

Check:

systemctl status ssh

Host Verification Failure

Check:

~/.ssh/known_hosts

Authentication Failure

ssh -vvv user@server

Session Failure

Inspect:

/var/log/auth.log

22. Security Notes

Always verify host keys.

Prefer:

Public Key Authentication

over passwords.

Keep algorithms modern:

ED25519

Curve25519

ChaCha20

Avoid obsolete algorithms.

23. Interview Questions

What is the first step in SSH connection lifecycle?

Answer:

DNS Resolution

What creates the encrypted tunnel?

Answer:

Key Exchange + Encryption Setup

What file stores trusted host keys?

Answer:

~/.ssh/known_hosts

What happens after authentication?

Answer:

Session Creation

What are SSH channels?

Answer:

Logical streams inside a connection.

24. Hands-On Labs

Lab 1

Observe Lifecycle

ssh -vvv localhost

Watch:

Version Exchange

Algorithm Negotiation

Authentication

Lab 2

View Known Hosts

cat ~/.ssh/known_hosts

Lab 3

List Algorithms

ssh -Q cipher

Lab 4

List KEX Algorithms

ssh -Q kex

Lab 5

Capture Connection

Terminal 1:

sudo tcpdump -i any port 22

Terminal 2:

ssh localhost

Observe packets.

25. Exercises

Exercise 1

Draw the complete SSH lifecycle.

Exercise 2

Explain why host verification is necessary.

Exercise 3

Describe how key exchange works.

Exercise 4

List all authentication methods.

Exercise 5

Explain the purpose of channels.

26. Quiz

Question 1

First stage?

A. Authentication
B. DNS Resolution
C. Session Creation
D. Encryption

Answer:

Question 2

Which stage verifies server identity?

A. Key Exchange
B. Session Creation
C. Host Verification
D. TCP Handshake

Answer:

Question 3

When does encryption start?

A. Before TCP
B. After Key Exchange
C. Before DNS
D. After Shell

Answer:

Question 4

Which stage creates the user environment?

A. Session Creation
B. DNS
C. TCP
D. Host Verification

Answer:

Question 5

What appears at the end of the lifecycle?

A. Host Key
B. Session Key
C. Interactive Shell
D. TCP ACK

Answer:

Summary

You should now understand:

✓ DNS Resolution

✓ TCP Handshake

✓ Protocol Version Exchange

✓ Algorithm Negotiation

✓ Host Verification

✓ Key Exchange

✓ Encryption Setup

✓ Authentication

✓ Session Creation

✓ Channel Creation

✓ Interactive Shell

✓ Complete SSH Connection Lifecycle

Next Topic:

Topic #5 — First SSH Connection

Connecting by IP
Connecting by Hostname
Port Selection
Username Resolution
First Login Warning
known_hosts Creation
Basic Navigation
Disconnecting
Connection Errors
Connection Debugging

Topic

Table of Contents

1. What is the SSH Connection Lifecycle?

Why It Matters

High-Level Lifecycle

2. Complete Lifecycle Overview

Master Flow Diagram

3. DNS Resolution

Example

DNS Lookup

Example Result

Verification

Failure Example

4. TCP Handshake

Purpose

Three-Way Handshake

Result

Verify

Failure Example

5. Protocol Version Exchange

Example

Why?

Packet View

Failure Example

6. Algorithm Negotiation

Why?

Negotiated Categories

Example

Negotiation Diagram

Verify

Example Output

7. Host Verification

Why?

Server Presents

First Connection

known_hosts

Verification Flow

Warning Example

8. Key Exchange

Goal

Common Algorithms

Simplified Flow

Important

Diagram

Result

9. Encryption Setup

Purpose

Common Ciphers

Before Encryption

After Encryption

Encryption Diagram

10. Authentication

Authentication Methods

Password Authentication

Public Key Authentication

Authentication Flow

Failure Example

11. Session Creation

What Is a Session?

Example

Session Diagram

12. Channel Creation

Why?

Diagram

Channel Types

Session Channel

Exec Channel

SFTP Channel

Forwarding Channel

13. Interactive Shell

User Receives

What Happens?

Example

User Can Now

14. Full Packet Flow

15. Lifecycle Diagram

16. Commands

17. Code Examples

18. Real-World Examples

19. Production Examples