Reverse SSH is an SSH arrangement where the internal host starts the connection outward to a server that an attacker or administrator can reach. Instead of waiting for an inbound login, the host creates a tunnel that can be used to send traffic back into a private network, often through remote port forwarding. This is useful in normal administration when firewalls block direct access, but it is also attractive to attackers because outbound connections are often easier to allow than inbound ones.
In cyber security, reverse SSH matters because it can provide quiet persistence after compromise. A tunnel may let an operator reconnect to an internal system, pivot to other hosts, or expose a service without opening a new listening port on the target. Defenders look for unusual outbound SSH sessions, long-lived tunnels, unexpected port forwarding, and SSH processes on servers that should not initiate them. Blocking unnecessary egress, restricting SSH keys, and monitoring management hosts helps reduce the risk.