SSH provides encrypted remote command-line access, file transfer (SFTP/SCP), and port forwarding. Replaces insecure Telnet, rsh, and rlogin. Port 22.
Always use key-based SSH authentication — disable password authentication. Restrict SSH to specific source IPs. Use a jump host (bastion server) for SSH to production systems. Port 22 attacks are constant — consider changing the port (security through obscurity but reduces automated attacks).