Skip to content

SSH — Secure Shell Configuration & Usage

Last reviewed: 2026-05-29

SSH (Secure Shell) is a cryptographic network protocol used for secure remote access to systems and secure data communication over unsecured networks. It provides strong authentication, encrypted communication, and integrity protection.

Overview

SSH replaces insecure protocols like Telnet, rlogin, and FTP. It's the standard method for accessing Linux/Unix servers remotely, managing infrastructure, and automating deployments.

Training Content

  • Generate an Ed25519 key pair (ssh-keygen -t ed25519)
  • Locate the public key (~/.ssh/id_ed25519.pub)
  • Copy it to a remote server using ssh-copy-id

SSH Key Generation

# Generate Ed25519 key (recommended — faster and more secure than RSA)
ssh-keygen -t ed25519 -a 100 -C "your_email@example.com"

# Generate RSA key (fallback for older systems)
ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

This creates: - ~/.ssh/id_ed25519 — Private key (never share this!) - ~/.ssh/id_ed25519.pub — Public key (add to servers)

Deploying Your Public Key

# Copy to remote server (automatically adds to ~/.ssh/authorized_keys)
ssh-copy-id user@server-ip

# Manual method
cat ~/.ssh/id_ed25519.pub | ssh user@server-ip "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

SSH Configuration (~/.ssh/config)

Manage multiple hosts with custom settings:

Host myserver
    HostName 192.168.1.100
    User paul
    Port 2222
    IdentityFile ~/.ssh/id_ed25519
    ForwardAgent yes

Host github.com
    User git
    IdentityFile ~/.ssh/github_key

Then connect with just: ssh myserver

Common Commands

Command Purpose
ssh user@host Standard connection
ssh -p 2222 user@host Connect on non-default port
ssh -i ~/.ssh/key user@host Use specific key file
scp file user@host:/path/ Secure copy (to server)
scp user@host:/path/file . Secure copy (from server)
rsync -avz -e ssh user@host:/src/ /dst/ Sync files over SSH
ssh -L 8080:localhost:80 user@host Local port forwarding
ssh -D 1080 user@host SOCKS proxy (dynamic forwarding)
ssh -J jumpuser@jumphost target Jump host/bastion

Security Hardening

Edit /etc/ssh/sshd_config on the server:

# Disable password authentication (keys only)
PasswordAuthentication no

# Disable root login
PermitRootLogin prohibit-password

# Use only protocol 2
Protocol 2

# Change default port (reduce automated attacks)
Port 2222

# Limit users
AllowUsers paul deploy

# Key exchange algorithms (use strong ones)
KexAlgorithms curve25519-sha256,diffie-hellman-group16-sha512

# Enable 2FA when needed
AuthenticationMethods publickey,keyboard-interactive

Then restart: sudo systemctl restart sshd

Key File Permissions

SSH is strict about file permissions:

File Permission Command
~/.ssh/ 700 chmod 700 ~/.ssh
~/.ssh/id_rsa (private key) 600 chmod 600 ~/.ssh/id_rsa
~/.ssh/id_rsa.pub (public key) 644 chmod 644 ~/.ssh/id_rsa.pub
~/.ssh/authorized_keys 600 chmod 600 ~/.ssh/authorized_keys
~/.ssh/config 600 chmod 600 ~/.ssh/config

Troubleshooting

ssh -vvv user@host      # Verbose debug output
ssh-keygen -l -f key.pub  # View key fingerprint
ssh-keygen -R hostname    # Remove host key from known_hosts
ssh-keyscan hostname      # Get remote host public key

Resources