SSH — encrypted remote login, remote command execution, and the transport under scp/sftp and git-over-ssh.
sshd listens on 22, exchanges a version banner, then runs a key exchange that authenticates the server by host key and the user by public key, password, or keyboard-interactive. On top of that transport ride interactive shells, port forwards, sftp, and git@host clones. It is on essentially every Linux and BSD host and on macOS when Remote Login is enabled. On a public IP it gets continuous automated password-guessing traffic, which is noise, not a breach.
Fine to expose
Safe to expose with public-key auth only and PasswordAuthentication disabled; the risk is weak passwords, not the port.
$ nc -v github.com 22Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.