{
  "port": 22,
  "protocol": "tcp",
  "service": "SSH",
  "oneLiner": "SSH — encrypted remote login, remote command execution, and the transport under scp/sftp and git-over-ssh.",
  "whatItIs": "sshd listens on 22, exchanges a version banner, then runs a key exchange that authenticates the server by host key and the user by public key, password, or keyboard-interactive. On top of that transport ride interactive shells, port forwards, sftp, and `git@host` clones. It is on essentially every Linux and BSD host and on macOS when Remote Login is enabled. On a public IP it gets continuous automated password-guessing traffic, which is noise, not a breach.",
  "exposure": {
    "verdict": "fine",
    "note": "Safe to expose with public-key auth only and PasswordAuthentication disabled; the risk is weak passwords, not the port."
  },
  "checkCommand": "nc -v github.com 22",
  "links": [
    {
      "title": "RFC 4253 — The Secure Shell (SSH) Transport Layer Protocol",
      "url": "https://www.rfc-editor.org/rfc/rfc4253.html",
      "kind": "spec"
    },
    {
      "title": "OpenSSH (official project site)",
      "url": "https://www.openssh.org/",
      "kind": "official-docs"
    },
    {
      "title": "Portable OpenSSH source repository",
      "url": "https://github.com/openssh/openssh-portable",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}