What is SSH - the protocol and what is ssh - the utility?

Question

What is SSH - the protocol?
What is ssh - the unix utility and how does it work?

How is SSH protocol related to SFTP?

What is sshd?

Does the command su use ssh or sshd?

Answer 1

The SSH protocol is defined by what the ssh and sshd programs accept. (There is a standard defined for it, but it's an after-the-fact thing and is mostly ignored when one of the implementations adds new features.) Since there are multiple implementations of those (OpenSSH, F-Secure, PuTTY, etc.) occasionally you'll find that one of them doesn't support the same protocol as the others. Basically, it defines authentication negotiation and creation of a multiplexed data stream. This stream can carry one or more (with OpenSSH and ControlMaster) terminal sessions and zero or more tunnels (forwarding socket connections from either local or remote to the other side; X11 forwarding is a special case of remote forwarding). It also defines "subsystems" that can be used over the stream; terminal sessions are the basic subsystem but others can be defined. sftp is one of these.

ssh the utility uses the SSH protocol to talk to sshd on another machine. How it works depends on what version it is (see above), but the gist of it is that it attempts to figure out which version of the SSH protocol to use, then it and sshd negotiate supported authentication methods, then it tries to authenticate you using one of those methods (asking for remote user password/private key paasword/S-Key phrase as necessary), and on successful authentication sets up a multiplexed stream with the sshd.

sshd, as said above, implements the server side of the SSH protocol.

sftp is a (at present, the only standard) subsystem defined in most sshd implementations. When the SFTP subsystem is requested, sshd connects sftp-server to the subsystem session; the sftp program then talks to it, similarly to ftp but with file transfers multiplexed on the stream instead of using separate connections as with ftp.

su has nothing to do with ssh, sshd, or sftp, except insofar as there may be PAM modules to arrange for the multiplexed stream to be available within the shell or program run by it.

Answer 2

SSH (stands for "Secure SHell") is a network protocol which described in RFC4251. ssh utility is SSH client that connects to SSH daemon and presents "Secure SHell" to user. SFTP is FTP-like protocol which works over SSH connection.

su command does not use ssh or sshd in any way, it just allows you to run processes with different privileges.

Answer 3

SSH is a protocol for secure communication over an insecure network. It allows for end to end encryption of all communication such that it cannot (feasibly) be intercepted and decrytped.

ssh the utility is an implementation of the protocol. SFTP is a subsystem of ssh that uses the protocol for secure password and file transfer.

su does not use the ssh protocol.

Answer 4

Take a look at the OpenSSH project. It has all the info you're looking for.

Briefly, the SSH protocol permits the secure (encrypted) connection between two hosts. The ssh utility is a client program to log into a remote system using the SSH protocol, and it has a lot of other uses, too, like [reverse] tunneling/port forwarding/...

sshd it's the server software. It provides a daemon which responds to incoming SSH requests.

su has nothing to do with ssh. It's used to change the active user (the most frequent use it's to become root).