SSH, Remote Auth & Port Forwarding: Protocols, Encryption & Security

TAKEAWAYS:

• SSH uses asymmetric encryption (RSA/ECDSA) for key exchange and symmetric encryption (AES/ChaCha20) for session data, ensuring confidentiality and integrity via HMAC.
• Mutual authentication in SSH requires both client and server to prove identity (e.g., via host keys and user credentials), while one-way authentication verifies only the server.
• Port forwarding in SSH creates secure tunnels: local forwarding redirects traffic to a remote port, and remote forwarding exposes local services securely.
• SSH’s connection protocol involves a handshake with key exchange, authentication, and session setup—visualized as a sequence diagram of SSH_MSG_* messages.
• Real-world applications include eSewa’s secure API calls, Ncell’s remote server management, and Khalti’s encrypted payment gateways using SSH tunnels.
• Weaknesses like brute-force attacks on passwords or misconfigured forwarding can be mitigated with key-based authentication and fail2ban.

1. Secure Shell (SSH): Architecture and Key Concepts

SSH (Secure Shell) is a cryptographic network protocol for secure remote login, command execution, and file transfers over untrusted networks (e.g., the internet). It replaces insecure protocols like Telnet/FTP by encrypting all traffic and providing authentication, confidentiality, and integrity.

1.1 SSH Protocol Layers

SSH operates in three layers, each with distinct functions:

• Transport Layer:

  • Handles key exchange, server authentication, and encryption negotiation.
  • Uses asymmetric encryption (RSA, ECDSA) for key exchange and symmetric encryption (AES, ChaCha20) for data.
  • Implements message authentication codes (MACs) like HMAC-SHA256 for integrity.

• User Authentication Layer:

  • Verifies the client’s identity (e.g., passwords, public-key cryptography).
  • Supports mutual authentication (both client and server prove identity).

• Connection Layer:

  • Manages multiple sessions (e.g., shell, port forwarding) over a single encrypted tunnel.

1.2 SSH Key Exchange: Diffie-Hellman and RSA

SSH uses ephemeral Diffie-Hellman (ECDH) or RSA for key exchange:

• ECDH (Elliptic Curve Diffie-Hellman):
  • Generates a shared secret without transmitting it over the network.
  • More efficient and secure than traditional DH.
• RSA:
  • Used for host key verification (server sends its public key; client checks against a known fingerprint).

1.3 SSH Authentication Methods

Worked Example: SSH Public Key Authentication

1. Key Generation:

   ssh-keygen -t ed25519 -C "user@example.com"
   

   • Generates id_ed25519 (private key) and id_ed25519.pub (public key).
2. Key Transfer:
   • Public key is copied to the server’s ~/.ssh/authorized_keys.
3. Authentication:
   • Client sends a signature of a random challenge using the private key.
   • Server verifies the signature against the public key.

2. Remote Authentication: Symmetric vs. Asymmetric

Remote authentication ensures only authorized users access a system. SSH supports both symmetric and asymmetric encryption methods.

2.1 Symmetric Encryption for Authentication

• Uses a shared secret key (e.g., Kerberos tickets, shared passwords).
• How it works:
  1. Client and server agree on a pre-shared key (PSK).
  2. Client sends an encrypted challenge (e.g., HMAC-SHA1(PSK || nonce)).
  3. Server verifies the HMAC.

Limitations:

• Key distribution is problematic (must be shared securely).
• Vulnerable to man-in-the-middle (MITM) if keys are leaked.

Example: Kerberos in SSH

• Used in enterprise environments where SSH integrates with Active Directory.
• Client obtains a Ticket Granting Ticket (TGT) from a Key Distribution Center (KDC).

2.2 Asymmetric Encryption for Authentication

• Uses public-key cryptography (RSA, ECDSA, Ed25519).
• Mutual Authentication:
  • Server authenticates to client: Server sends its public key; client checks against a trusted list (e.g., /etc/ssh/ssh_known_hosts).
  • Client authenticates to server: Client proves ownership of a private key (e.g., via a signature).
• One-Way Authentication:
  • Only the server proves its identity (default in SSH).

Comparison Table:

Worked Example: Mutual Authentication with RSA

1. Server Authentication:
   • Server sends its RSA public key (ssh-rsa AAA...).
   • Client checks if the key matches the fingerprint in known_hosts.
2. Client Authentication:
   • Client signs a random challenge with its private key.
   • Server verifies the signature using the client’s public key.

3. SSH Port Forwarding: Local vs. Remote

SSH’s port forwarding creates encrypted tunnels to securely access services. Two types:

3.1 Local Port Forwarding

• Redirects local traffic to a remote port over an SSH tunnel.
• Use Case: Access a database on a remote server securely from your laptop.

How it works:

ssh -L 8080:localhost:3306 user@remote-server

• Traffic Flow:

  Local Machine (Port 8080) → SSH Tunnel → Remote Server (Port 3306)
  

• Real-World Example:
  • Ncell engineers use local forwarding to access internal databases from home without VPNs.
  • eSewa developers tunnel API calls through SSH to test backend services securely.

Mermaid Diagram:

sequenceDiagram
    participant LocalApp as Local App (Port 8080)
    participant SSHClient as SSH Client
    participant RemoteServer as Remote Server (Port 3306)
    LocalApp->>SSHClient: Sends data to port 8080
    SSHClient->>RemoteServer: Forwards over SSH tunnel
    RemoteServer-->>SSHClient: Returns encrypted response
    SSHClient-->>LocalApp: Decrypts and sends back

3.2 Remote Port Forwarding

• Exposes a local service to the internet via a remote SSH server.
• Use Case: Host a web server on your home machine but access it via a friend’s SSH server.

How it works:

ssh -R 8080:localhost:80 user@remote-server

• Traffic Flow:

  Internet → Remote Server (Port 8080) → Local Machine (Port 80)
  

• Real-World Example:
  • Freelancers use remote forwarding to host a personal website on their home PC via a VPS.
  • Nepalese startups test web apps behind firewalls by forwarding ports through a cloud SSH server.

Comparison:

4. SSH Connection Protocol: Message Exchange

SSH establishes a secure connection via a handshake with specific messages (SSH_MSG_*). The process:

Key Steps:

1. Key Exchange (SSH_MSG_KEXINIT):
   • Client and server agree on algorithms (e.g., curve25519-sha256).
   • Exchange ephemeral keys for ECDH.
2. Host Key Verification:
   • Server sends its host key (RSA/ECDSA).
   • Client checks if the key matches a trusted fingerprint.
3. Authentication:
   • Client sends SSH_MSG_USERAUTH_REQUEST (password/public key).
4. Session Setup:
   • Both sides switch to encrypted communication (SSH_MSG_NEWKEYS).

Worked Example: SSH Handshake Trace

1. Client connects to ssh.example.com:22.
2. Server responds with:

   SSH-2.0-OpenSSH_8.2
   

3. Client sends SSH_MSG_KEXINIT with supported algorithms:
   • KEX: curve25519-sha256
   • Encryption: chacha20-poly1305@openssh.com
   • MAC: hmac-sha256
4. Server replies with its host key (ssh-rsa AAA...) and signs a hash of the exchange.
5. Client verifies the host key against /etc/ssh/ssh_known_hosts.
6. Authentication: Client sends a public key signature.
7. Session starts: All further traffic is encrypted.

5. Real-World Applications of SSH

SSH is ubiquitous in secure remote access, encryption, and tunneling. Here’s how Nepalese and global companies use it:

5.1 eSewa: Secure API Calls

• How SSH is used:
  • eSewa’s backend services communicate via SSH tunnels to encrypt API calls between microservices.
  • Mutual authentication ensures only authorized services can access payment processing modules.
• Why it matters:
  • Prevents replay attacks and data tampering in financial transactions.

5.2 Ncell: Remote Server Management

• How SSH is used:
  • Ncell’s network operations team uses SSH with key-based authentication to manage routers and base stations.
  • Local port forwarding allows engineers to access internal databases from home without VPNs.
• Example Command:

  ssh -L 9000:internal-db:5432 admin@ncell-gateway
  

5.3 Khalti: Encrypted Payment Gateways

• How SSH is used:
  • Khalti’s payment processing servers use SSH tunnels to securely relay transactions to banks.
  • Remote forwarding exposes internal services to payment gateways without opening ports directly.
• Security Benefit:
  • Mitigates MITM attacks on payment data.

5.4 Pathao: Driver-App Communication

• How SSH is used:
  • Pathao’s backend uses SSH for secure shell access to debug driver apps in real-time.
  • Key rotation ensures compromised keys don’t grant long-term access.

5.5 NEPSE: Secure Market Data Feeds

• How SSH is used:
  • NEPSE’s stock market data feeds are encrypted using SSH tunnels to prevent spoofing.
  • Mutual authentication ensures only authorized brokers receive real-time quotes.

6. Common SSH Attacks and Mitigations

Best Practices:

• Disable password authentication: Edit /etc/ssh/sshd_config:

  PasswordAuthentication no
  PubkeyAuthentication yes
  

• Use strong keys: Prefer ed25519 over RSA.
• Rotate keys: Change host and user keys periodically.
• Monitor logs: Check /var/log/auth.log for failed attempts.

7. Exam Tip: How to Score Full Marks

This unit is heavily tested on:

1. SSH Protocol Steps:
   • Draw the sequence diagram of SSH_MSG_KEXINIT to SSH_MSG_NEWKEYS.
   • Explain mutual vs. one-way authentication with asymmetric keys.
2. Port Forwarding:
   • Differentiate local vs. remote forwarding with command examples.
   • Describe a real-world use case (e.g., Ncell’s database access).
3. Key Exchange:
   • Compare ECDH vs. RSA in SSH (speed, security, use cases).
4. Authentication:
   • Explain how symmetric encryption (Kerberos) vs. asymmetric (RSA) works in SSH.
5. Attacks:
   • Name 2 attacks (e.g., brute force, MITM) and their fixes.

Common Pitfalls:

• Forgetting to mention HMAC for integrity in SSH.
• Confusing local forwarding (-L) with remote forwarding (-R).
• Not including real-world examples in answers (examiners love these!).

Model Answer Structure:

1. Define SSH and its layers (transport, auth, connection).
2. Explain key exchange (ECDH/RSA) with a diagram.
3. Compare symmetric/asymmetric auth with a table.
4. Describe port forwarding with commands and a sequence diagram.
5. Give a real-world example (e.g., eSewa’s API tunneling).
6. Mention 1 attack and mitigation.