Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I log in to my server through ssh and copy files to my local computer can I be eavesdropped?

How do I make sure nobody can intercept the data or even know what I am copying?

Are there levels of security in SSH?

share|improve this question
up vote 4 down vote accepted

SSH uses encryption which makes eavesdropping pointless. All an eavesdropper would see is ciphertext, i.e. random data.

You can make sure no one intercepts the data by ensuring the SSH server fingerprint reported by your SSH client is what you are expecting.

SSH does not hide the IP you are connecting to or the length of time you are connected. It does not transmit information by itself - when the connection is idle, so is SSH (minor exception is some clients [namely PuTTY] have a "keepalive" option whereby packets are sent just to keep the connection from timing out). This information may be used by an attacker to correlate your activity with certain files or activities. There are ways to obfuscate this if you are very paranoid.

There are different SSH versions - you want to use version 2 and never any earlier versions.

SSH is a network application protocol - it creates a "pipe" between you and a remote system. So it is merely concerned with delivering the data the server wants to display to you, and transmitting what you type back to the server. Accounts, access control, and login remain the responsibility of the operating system. SSH does not change anything with regard to that.

This means "access levels" are separately your responsibility as a system administrator - a given account will have the same capabilities whether they login locally or via SSH.

The sshd_config has an option to deny root the ability to directly login (does not affect sudo or su). Generally this is considered a good thing, as remote root access would then require two passwords instead of one.

share|improve this answer

Between the Daemon on your server and the client on your local machine, there is no way to read the content or type of file. That is the point of SSH.
That being said, the approximate size of the file is easy to discern, as is the source and destination.

To answer the "levels of security" part, I will need more information.
If you are talking about Passwords vs private key, yes: keys are more secure.
If you are talking about 512 bit vs 1024 bit, yes: the more bits the better (if the daemon supports it)
if you are talking about "this is encrypted and that is not," no: everything is encrypted.

Hope this helps

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.