SSH basics

How SSH works

The few ideas behind every SSH connection: address, port, user, sign-in and host keys.

What SSH is

SSH (Secure Shell) lets you log in to another computer over the network and use its command line as if you were sitting at it. Everything is encrypted.

There are two sides:

The server. It runs an SSH server, usually OpenSSH. The program is called sshd.
The client. That is Termphin, or ssh on a computer.

What you need to connect

Three things:

An address. An IP like 192.168.1.20 or a name like server.example.com.
A port. 22 unless the server uses another one.
A username on that machine.

On a computer, the same connection looks like this:

ssh [email protected] -p 22

In Termphin, these are the Host, Port and Username fields.

Signing in

Signing in proves you are allowed to use the machine. Two ways:

A password.
An SSH key. A key is a pair: the private half stays with you, the public half goes on the server. Keys are safer and you do not type anything.

Some servers add a second step, such as a one-time code. See SSH keys and two-factor sign-in.

Host keys

Host keys prove the server is the real one. The first time you connect, the client shows the server’s fingerprint and asks you to trust it. After that, it checks the key every time and warns you if it changes. This is called trust on first use. See host keys.

What you get

Once signed in, you get a shell: the command line. The same connection also carries file transfer (SFTP) and tunnels (port forwarding). In Termphin, that is the terminal, the SFTP browser and Manage Tunnels.

Local network and the internet

A machine at home is reachable from your phone on the same Wi-Fi by its local address, like 192.168.x.x or 10.x.x.x. From elsewhere, you need one of these:

A public address.
Port forwarding on the router. Not recommended for beginners.
A VPN, such as Tailscale or WireGuard.

Termphin’s Fallback addresses let one machine have both a home address and a VPN address. See managing machines.

Encryption

Termphin prefers ChaCha20-Poly1305, then AES-CTR. It uses AES-GCM only for a server that offers nothing else. No weaker ciphers.