What is SSH?

How SSH works

SSH connections follow a client-server model: an SSH client (a terminal app or a dedicated tool such as OpenSSH or PuTTY) connects to an SSH server running on the remote machine, usually on TCP port 22. The two negotiate an encrypted session, and then you authenticate with a password or an SSH key pair. From that point, everything you send, including credentials and commands, travels encrypted.

That encryption is the whole point. Tatu Ylönen designed SSH in 1995 to replace Telnet and rsh, remote login tools that sent passwords across the network as readable text. Administrators use SSH to remotely manage servers, routers, virtualization platforms, and operating systems, and it underpins secure file transfer tools such as SFTP and SCP.

Connecting to a server with SSH

Open a terminal and run ssh [email protected], swapping in your own shell username and your server's hostname. On the first connection, your client shows the server's host key fingerprint and asks whether to continue. Don't just type yes. Compare the fingerprint with the value shown in your hosting panel, or with one your server administrator gives you through a channel you already trust. If it matches, accept it and the client will remember that server. If it doesn't, stop and ask your host: an unexpected mismatch can mean another machine is impersonating your server. Once past the host key, enter your password or let your key handle it.

There's nothing to install on a modern computer: macOS, Linux, and Windows 10 and later all include the OpenSSH client, so the built-in terminal is enough. PuTTY is the common standalone choice on Windows. The prerequisite lives on the server side, though. Your hosting user needs shell access enabled before the server will let you log in.

SSH keys

An SSH key pair replaces your password with cryptography. The public key sits on the server, the private key stays on your computer, and the server lets you in only when the two match. One command, ssh-keygen, creates the pair. Key authentication resists password guessing and credential replay: there's nothing to brute-force in a login form and nothing reusable to capture in transit. The private key is still a credential, though, and anyone who copies the file can use it. Protect it with a passphrase when ssh-keygen offers one, and keep the file's permissions restricted to your own user.

Keys also let scripts, configuration management tools, and automated backup jobs log in with no human at the keyboard. Give each job its own key with only the access it needs, and remove keys when the job is retired. The rule of thumb: use key authentication wherever the server allows it. DreamHost shell users can set up passwordless key login.

SSH vs. SFTP vs. FTP

The three overlap in name more than in job:

• SSH is an encrypted session for logging in to a remote server and running commands.
• SFTP (SSH File Transfer Protocol) moves files over an SSH connection, so it inherits SSH's encryption.
• FTP (File Transfer Protocol) is the older transfer protocol; it sends files and passwords unencrypted.

Use SSH when you need to run commands, SFTP when you only need to move files, and skip plain FTP unless a legacy system leaves you no choice.

SSH on a DreamHost account

Shell access is included with DreamHost's hosting plans, from web hosting through VPS, dedicated servers, and DreamPress, but it's off by default: it has to be enabled for each user on your account. In the panel, switch your website user to a shell user, following DreamHost's guide to creating a user with shell access; DreamPress users get an SSH toggle instead. A domain registration alone has no server behind it, so there's nothing to log in to. Once you're in, the jobs worth learning first are the everyday ones:

• Editing configuration files in place instead of downloading and re-uploading them
• Running WP-CLI commands to update or troubleshoot a WordPress site
• Reading error logs the moment something breaks
• Compressing and moving large files faster than a graphical client can

Full root access is a separate entitlement. DreamHost provides root and sudo only on a self-managed VPS or a dedicated server, where you administer the machine yourself. Managed plans, including DreamPress and DreamHost Managed VPS, don't include root, because we handle the system administration on those. The support article Is root/sudo access available? lists which plans currently include it. Whatever your plan, turn shell access on before you need it. The day your site is down is the wrong day to set up SSH.