What is SSH?
Secure Shell
SSH (Secure Shell) is the encrypted protocol used to log in to routers, switches and servers remotely and run commands on them, normally over TCP port 22.
SSH runs over TCP and replaced Telnet and rlogin, which sent everything, passwords included, as readable text. The current protocol, SSH-2, is described in RFCs 4251 to 4254. When a client connects, the two sides agree on algorithms and set up an encrypted channel, and the server proves its identity with a host key. The first time you connect, the client shows that key's fingerprint and, once you accept it, remembers it in known_hosts; a later warning that the key has changed means either the device was rebuilt or something is intercepting the connection, and it should be investigated rather than clicked through. The user then authenticates, either with a password or, better, with a key pair: the private key stays on your machine and the server holds only the public key. Besides interactive shells, SSH carries file copies (scp, sftp), port forwarding, and the connections that automation tools such as Ansible use to configure devices.
On network devices, SSH is the front door, so it deserves the same care as any other exposed service. Good practice is to listen only on a management address, allow it through the router's input firewall only from management networks, use key-based login and disable passwords once keys work, and turn off the obsolete SSH-1 protocol where a device still offers it. A classic lockout is disabling password authentication before checking that the key login works; on a remote router, use a commit-confirm style rollback for changes like this. The Setting up VyOS with basic BGP lesson locks SSH down to a management address with key-only login, and Operating VyOS uses it for automation.
Lessons that use SSH
- Setting up VyOS with basic BGPTeaches this term · Intermediate · 50 min
Build a VyOS edge router from scratch: one upstream transit provider, one Internet Exchange route server, and the import and export policy that keeps both safe. Every command and output comes from a real VyOS lab.
- Operating VyOS: monitoring, backups and automationIntermediate · 50 min
Everything after it works: remote syslog, SNMP counters, NetFlow, config archives, commit-confirm and Ansible, all on one VyOS router and an ops server, including three places where this VyOS build differs from older guides.
- Edge and core: building out a VyOS networkIntermediate · 60 min
Split one BGP router into edge routers that face the outside world and a core that carries traffic inside: loopbacks, OSPF for infrastructure, iBGP between loopbacks, next-hop-self, and what happens when a link fails. Built and broken on three real VyOS routers.
- Zone-based firewall on VyOSIntermediate · 35 min
Rebuild the NAT lesson's router with a zone-based firewall: WAN, LAN, a DMZ and the router itself, with one ruleset per direction. Includes the missing-return-traffic mistake, post-NAT matching, and a full test matrix.
- Building a network lab on an Apple Silicon MacBeginner · 45 min
Run real network labs on an M-series Mac: native FRR and Linux containers, x86-only images through Rosetta, and full x86 VyOS VMs under QEMU in Docker, with the pitfalls that stop most people and a starter lab that mixes all three.
- Setting up VyOS with NATBeginner · 45 min
A VyOS router with a NAT interface for a private LAN and a public interface for a routed public subnet: plain routing, source NAT, port forwarding and the forward firewall that NAT isn't. Every output comes from a real VyOS lab.