SSH, The Secure Shell: The Definitive Guide, 2nd Edition

History of SSH

SSH1 and the SSH-1 protocol were developed in 1995 by Tatu Ylönen, a researcher at the Helsinki University of Technology in Finland. After his university network was the victim of a password-sniffing attack earlier that year, Ylönen whipped up SSH1 for himself. When beta versions started gaining attention, however, he realized his security product could be put to wider use.

In July 1995, SSH1 was released to the public as free software with source code, permitting people to copy and use the program without cost. By the end of the year, an estimated 20,000 users in 50 countries had adopted SSH1, and Ylönen was fending off 150 email messages per day requesting support. In response, Ylönen founded SSH Communications Security Corp., (SCS, http://www.ssh.com/) in December of 1995 to maintain, commercialize, and continue development of SSH. Today he is a board member and technical advisor to the company.

Also in 1995, Ylönen documented the SSH-1 protocol as an Internet Engineering Task Force (IETF) Internet Draft, which essentially described the operation of the SSH1 software after the fact. It was a somewhat ad hoc protocol with a number of problems and limitations discovered as the software grew in popularity. These problems couldn’t be fixed without losing backward compatibility, so in 1996, SCS introduced a new, major version of the protocol, SSH 2.0 or SSH-2, that incorporates new algorithms and is incompatible with SSH-1. In response, the IETF formed a working group called Secure Shell (SECSH) to standardize the protocol and guide its development in the public interest. The SECSH working group submitted the first Internet Draft for the SSH-2.0 protocol in February 1997.

In 1998, SCS released the software product SSH Secure Shell (SSH2), based on the superior SSH-2 protocol. However, SSH2 didn’t replace SSH1 in the field: it was missing some features of SSH1 and had a more restrictive license, so many users felt little reason to switch, even though SSH-2 is a better and more secure protocol.

This situation changed with the appearance of OpenSSH (http://www.openssh.com/), a free implementation of the SSH-2 protocol from the OpenBSD project (http://www.openbsd.org/). It was based on the last free release of the original SSH, 1.2.12, but developed rapidly into one of the reigning SSH implementations in the world. Though many people have contributed to it, OpenSSH is largely the work of software developer Markus Friedl. It has been ported successfully to Linux, Solaris, AIX, Mac OS X, and other operating systems, in tight synchronization with the OpenBSD releases.

SCS has continued to improve its SSH products, in some cases beyond what OpenSSH supports. Its product line now carries the name Tectia. And nowadays there are dozens of SSH implementations, both free and commercial, for virtually all platforms. Millions of people use it worldwide to secure their communications.