> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/account-usage/ssh.md).

# SSH

#### Key Points

1. **SSH-Related Processes**:
   * **Source Host**: Processes like `ssh.exe` or third-party SSH client executables.
   * **Destination Host**: The SSH server process, typically `sshd`, handles incoming SSH connections.
2. **Important Registry Keys and Configuration Files**:
   * **Source Host**: Registry keys for third-party SSH clients (e.g., PuTTY stores sessions in `HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions`).
   * **Destination Host**: Configuration file `sshd_config` located in the SSH installation directory.
3. **Event Log Analysis**:
   * Windows does not natively log SSH connections in Event Viewer. However, third-party SSH server logs on the destination host can provide connection details.
4. **Alternate Secure Access Methods**:
   * Awareness of other secure access methods like OpenVPN or WireGuard used for secure connections.
5. **Security Configuration**:
   * Implementing strict access control and monitoring on SSH usage, especially for administrative access.
6. **Artifact Locations**:
   * Locating SSH client and server logs, configuration files, and relevant registry entries is crucial for thorough forensic investigation.

#### Considerations

* **Security Implications**: Unauthorized SSH access is a potential method for data exfiltration and lateral movement in cyber attacks.
* **Limited Windows Logging**: Native Windows Event Logs do not typically record SSH activities, necessitating reliance on third-party logs and tools for monitoring.
* **Encryption**: SSH encrypts all traffic, including login credentials, making network-based detection more challenging.

#### Technical Explanations

**SSH on Windows**

* **Windows 10 and Later**: Integrated OpenSSH client (`ssh.exe`) and server (`sshd`).
* **Third-Party Applications**: Applications like PuTTY, WinSCP, and Bitvise SSH Client are commonly used.

**Log Analysis**

* **SSH Server Logs**: On the destination host, `sshd` logs can be found in the installation directory, providing details on connections, authentication, and errors.
* **Client Logs**: Some SSH clients maintain logs of connection attempts and sessions.

**Security Settings**

* **Configuration Best Practices**:
  * Restricting SSH access to specific users and groups.
  * Disabling root login over SSH.
  * Using key-based authentication instead of passwords.
* **Monitoring and Auditing**:
  * Implementing centralized logging and monitoring solutions for SSH activities.

#### Example Logs

* **SSH Server Log Entry**:

  ```rust
  Accepted password for user1 from 192.168.1.100 port 54022 ssh2
  Session opened for user user1 by (uid=0)
  ```
* **PuTTY Session Registry Entry**:

  ```csharp
  HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\session_name
  "HostName"="192.168.1.100"
  "UserName"="user1"
  ```

#### Example Command Lines

* **Starting an SSH Session (Client)**:

```bash
ssh.exe user1@192.168.1.100
```

* **Basic Connection**

```bash
putty.exe -ssh username@hostname
```

* **Specifying a port**

```bash
putty.exe -ssh username@hostname -P portnumber
```

* **Using a Private Key**

```bash
putty.exe -ssh username@hostname -i C:\path\to\private_key.ppk
```

* **Saving Session Information**

```bash
putty.exe -load "session_name"
```

* **Enabling X11 Forwarding**
  * X11 forwarding is a feature of the SSH (Secure Shell) protocol that enables the graphical output of an application running on a remote server to be displayed on a local client machine.

```bash
putty.exe -ssh username@hostname -X
```