SSH stands for Secure Shell. It is a tool that allows an authorized person to control a computer, server, or router through a text-based command line.
When SSH is enabled on a router, someone with valid credentials—such as a password or authorized key—can connect to the router and enter commands directly. This is different from the normal router settings page, where you click buttons and choose options from menus.
SSH is designed for advanced users, network administrators, and technicians. It can be very useful, but it may also provide extensive control over the router. That is why it should only be enabled when there is a clear reason to use it.
What Can SSH Allow Someone to Do?
The exact abilities depend on the router, its firmware, and the account used. SSH access may allow someone to:
- View detailed system information.
- Read router logs.
- Restart network services.
- Change firewall or DNS settings.
- Modify configuration files.
- Install scripts or software when the firmware permits it.
- Restart or reset the router.
- Manage advanced VPN settings.
- Troubleshoot network problems.
On some routers, SSH provides full administrator access to the operating system. A person using it may be able to make changes that are not available through the normal web administration page.
What Does “SSH Is Enabled Locally” Mean?
When a router says SSH is enabled locally, it usually means that devices connected to the local network can attempt to reach the router’s SSH service. This can include computers connected through Wi-Fi or Ethernet and other devices placed on the same network segment.
Local SSH normally does not mean that anyone on the internet can connect directly. Internet-facing access is usually controlled by a separate setting named something like SSH from WAN, SSH Remote Access, or Remote Administration. Verify that those settings are disabled unless remote SSH is intentionally required and carefully restricted.
Local-only SSH is safer than internet-facing SSH, but it still adds another way to access the router. An infected or unauthorized device already inside the network may be able to find and target it.
Is SSH Secure?
SSH is designed to create an encrypted connection, protecting credentials and commands while they travel between the computer and the router. Encryption does not remove every risk, however. SSH may still be targeted through:
- Weak, default, or reused passwords.
- Outdated router firmware.
- Vulnerabilities in the SSH service or operating system.
- Incorrect access-control settings.
- Malware on another device in the home.
- Unauthorized devices connected to the network.
- Failure to verify the router’s SSH host key when connecting.
For example, a compromised smart television, camera, computer, or other device could scan the local network and discover that the router accepts SSH connections. It could then try common credentials or attempt to exploit a known vulnerability.
What Is an Attack Surface?
An attack surface is the collection of features, services, ports, accounts, and login methods that could potentially be targeted. Every service running on a router increases that surface slightly. Disabling an unused feature removes one possible way for an attacker or infected device to interact with the router.
Do Most Home Users Need SSH?
Most home users do not need SSH for ordinary activities such as browsing, streaming, online gaming, connecting phones, using smart televisions or printers, changing the Wi-Fi password, or opening the router’s normal administration page.
You may need SSH if you deliberately use custom router firmware, advanced networking scripts, specialized VPN settings, automated backups, configuration management, or command-line troubleshooting.
If you have never intentionally connected to the router with an SSH client or terminal command, you probably do not need the service enabled.
Before Disabling SSH
- Confirm that no scheduled script, backup, monitoring tool, VPN process, or support workflow depends on SSH.
- Save a current router configuration backup and review the recovery procedure.
- Confirm that the normal web administration page works and that you know its administrator password.
- Disable SSH during a maintenance window and test the router’s normal functions.
- Record the change in the private audit log, including why it was made and how to reverse it.
Privacy note: Keep configured ports, administrator usernames, host-key fingerprints, internal addresses, logs, and screenshots containing router details out of a public article.
Should You Disable It?
If SSH is not being used, disabling it is usually the simplest way to reduce the router’s attack surface. If it is required, keep it limited to trusted local devices when possible, use strong authentication, keep the firmware current, and avoid exposing the service directly to the internet.
On current GL.iNet firmware, the manufacturer separates the local Enable SSH control from SSH Remote Access. The names and menu locations can change with firmware versions, so consult the documentation for your device before changing anything. See the official GL.iNet Admin Access documentation.
The goal is not to disable features merely because they exist. It is to understand what each service does, decide whether it has a legitimate purpose, and remove access paths that are not needed.