Port 22: SSH
Analyze default service protocols, historical security vulnerabilities, hardening methods, and firewall rules for port 22.
1. Port Purpose & Usage
Secure Shell (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network. It is most commonly used for remote command-line login, shell access, and secure file transfers.
Common Service Implementations
The premier connectivity tool for remote login with the SSH protocol.
A lightweight SSH server optimized for embedded environments.
2. Security Risks & Vulnerability Profiles
Exposed SSH ports are constantly targeted by automated brute-force scripts. Weak passwords can lead to total system compromise. Additionally, SSH key mismanagement or vulnerabilities in SSH server daemons can allow unauthorized system access.
Historical CVE References
XZ Utils Backdoor. A malicious backdoor was injected into the upstream xz compression library, which is dynamically linked by OpenSSH in several Linux distributions, allowing remote attackers to bypass SSH authentication.
Debian OpenSSL Predictable PRNG. A Debian-specific package patch accidentally compromised the random number generator, resulting in predictable SSH host and user keys.
3. Hardening & Mitigation Checklist
4. Firewall Command Examples
Use the following system configurations to restrict open port exposure on Linux hosts:
Further Analysis
Remote Administration Ports
Ports often operate in clusters. When analyzing a service on Port 22, security engineers typically check the status of these related ports.