How SSH Was Born: The Story Behind the Command You Use Every Day
Published on 2026-09-12 by frfrand
Un ataque de captura de contraseñas en Helsinki en 1995, un investigador molesto, y el protocolo que reemplazó a telnet. También por qué OpenSSH existe y qué tiene que ver OpenBSD.
You write ssh and you enter. It is so everyday that it is hard to imagine that there was a world without it, and that that world ended relatively recently.
Before: everything in clear
Until the mid-nineties, connecting to a remote machine was done with telnet, rlogin or rsh. The three had one characteristic in common: they sent everything over the network unencrypted. Your user, your password and every command you wrote traveled in plain text.
It was not an oversight, it was the context. Those protocols were designed for academic networks where everyone knew each other and the idea of an attacker in the middle was not in anyone's mental model.
With the Internet growing, that assumption stopped holding.
1995, Helsinki
At the Helsinki University of Technology, a researcher named Tatu Ylönen discovered that someone had put a traffic sniffer on the university network and was collecting passwords. Thousands of them, just by listening.
His reaction was to write a replacement. In July 1995 he published SSH, Secure Shell: the same idea as rlogin but with encrypted traffic and server authentication, so that it cannot be impersonated.
He released it for free and adoption was immediate. By the end of that year there were estimated to be around 20,000 users in fifty countries. For an infrastructure tool in 1995, that is huge.
The license problem, and OpenSSH
The following year Ylönen founded a company to commercialize it, and new versions stopped being free. The world that already depended on SSH just watched.
In 1999 the OpenBSD team took the last free-licensed version (1.2.12), removed the restricted code, replaced the patented parts, and released OpenSSH.
That project is the one that ended up winning: when today you write ssh on Linux, macOS, or Windows, almost certainly you are using OpenSSH. That it is maintained by the OpenBSD people, obsessed with security to the point of auditing the code line by line, is not a minor detail for something that protects access to half the Internet.
SSH-1 and SSH-2 are not the same
The original protocol had design weaknesses that appeared over the years. SSH-2, standardized in 2006 in a series of RFCs, is a rewrite, not an update: it changes key exchange, separates authentication from transport, and allows negotiating algorithms.
That is why modern clients simply refuse to speak SSH-1. If you ever find a machine that only supports version 1, it is not a compatibility problem: it is a machine that needs to be retired.
What remained of all this
Three ideas from SSH became standard in almost everything that came after:
Authenticate the server, not only the client. That fingerprint in known_hosts exists so that no one can impersonate the machine.
Keys instead of passwords. The secret does not travel. Today it is the standard way to authenticate machines to each other, far beyond SSH.
An encrypted and multiplexed channel. SSH does not only carry your terminal: over the same connection travel file copies, port tunnels, and agent forwarding. The idea of "a secure channel with several things inside" is now everywhere.
Not bad for something that started because someone got angry seeing their password in someone else's log.