BeginnerLinux

SSH Fundamentals: Secure Remote Access and Administration

Learn SSH for secure remote access including key-based authentication, configuration, tunneling, port forwarding, and security hardening.

#SSH#remote access#encryption#Linux#secure communication

Securing Remote Access with SSH

Remote server administration is a daily task for every cybersecurity professional. SSH is the tool that makes it possible — and secure. Whether you are connecting to a compromised host during an incident, managing a firewall remotely, or tunneling traffic through an encrypted channel, SSH is your gateway. This guide walks through SSH setup, key-based authentication, and practical usage patterns.

Prerequisites

Basic Linux command line knowledge. Understanding of IP addresses and ports.

How SSH Works

The SSH Handshake

TCP connection on port 22

Version exchange between client and server

Key exchange using Diffie-Hellman (shared session key)

Server authentication via host key (verified against known_hosts)

User authentication (password or public key)

All subsequent traffic encrypted

Basic SSH Usage

ssh user@192.168.1.100              # Basic connection
ssh -p 2222 user@example.com        # Non-default port
ssh user@host "ls -la /var/log"     # Run single command
ssh -i ~/.ssh/id_rsa user@host     # Use specific identity file

SSH Config File (`~/.ssh/config`)

Host webserver
    HostName 192.168.1.100
    User admin
    Port 22
    IdentityFile ~/.ssh/webserver_key

Now connect with: ssh webserver

Key-Based Authentication

Generating Keys

ssh-keygen -t ed25519 -C "email@example.com"     # Recommended
ssh-keygen -t rsa -b 4096 -C "email@example.com" # Fallback

Copying Public Key

ssh-copy-id user@192.168.1.100
# Manual:
cat ~/.ssh/id_ed25519.pub | ssh user@host "cat >> ~/.ssh/authorized_keys"

Key Types

|------|----------|-------|----------------|

SSH File Transfer

# SCP
scp file.txt user@host:/path/          # Copy to server
scp -r dir/ user@host:/path/           # Copy directory
scp user@host:/var/log/syslog ./       # Copy from server
scp -P 2222 file.txt user@host:/tmp/   # Custom port

# SFTP (interactive)
sftp user@host
# Commands: ls, lls, get, put, rm, mkdir, exit

SSH Tunneling

Local Port Forwarding

ssh -L 8080:internal-server:80 user@gateway
# Access http://localhost:8080 to reach internal web server

Remote Port Forwarding

ssh -R 9000:localhost:3000 user@public-server
# Exposes local port 3000 on remote server's port 9000

Dynamic Port Forwarding (SOCKS Proxy)

ssh -D 1080 user@proxy-server
# Configure browser to use SOCKS5 at localhost:1080

Security Hardening

In /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
Port 2222
AllowUsers admin john
ClientAliveInterval 300
MaxAuthTries 3
LogLevel VERBOSE

sudo systemctl restart sshd

Real-World Examples

Jump Host: ssh -J bastion.example.com internal-server.local

Reverse Tunnel: Device behind NAT: ssh -R 2222:localhost:22 user@public-server then ssh -p 2222 localhost from public server.

SSH as VPN: Dynamic port forwarding encrypts browsing like a VPN.

Common Mistakes

Exposing SSH on default port (22 gets constant probes). Leaving password auth enabled. Sharing private keys. Not using ssh-agent for passphrases.

Best Practices

Use Ed25519 keys. Use an SSH agent. Implement fail2ban. Keep SSH updated. Use jump hosts for private networks. Disable SSH protocol 1.

Related Tools

Mosh — Mobile shell for high latency. autossh — Auto-restart tunnels. sshfs — Mount remote directories. fail2ban — Block brute force. ssh-audit — Test SSH config.

linux-commands-explained

command-line-essentials

linux-terminal-guide

firewall-fundamentals

vpn-guide

Summary

SSH provides encrypted remote access, file transfer (SCP/SFTP), and tunneling (local/remote/dynamic port forwarding). Best practices include Ed25519 keys, disabling password auth, changing the default port, and using jump hosts for private network access.

Knowledge Check

What port does SSH use by default?

What is the difference between key-based and password auth?

How do you copy a public key to a remote server?

What is SSH local port forwarding?

What config disables root login via SSH?

Frequently Asked Questions

What is the difference between SSH password and key-based authentication?

Password authentication sends your password (encrypted) to the server. Key-based authentication uses a cryptographic key pair — the public key on the server and private key on your client. Key-based auth is more secure against brute force and enables passwordless login. Always prefer keys.

How do I generate an SSH key pair?

Run `ssh-keygen -t ed25519 -C "email@example.com"` to generate an Ed25519 key (recommended). For RSA, use `ssh-keygen -t rsa -b 4096`. The private key (~/.ssh/id_ed25519) stays on your machine; the public key goes to the server. Ed25519 is faster and more secure than RSA.

How do I copy my public key to a remote server?

Use `ssh-copy-id user@host` for automatic setup. For manual installation, run `cat ~/.ssh/id_ed25519.pub | ssh user@host "cat >> ~/.ssh/authorized_keys"`. The server must have SSH enabled and the authorized_keys file must have correct permissions (600).

What is SSH tunneling and when should I use it?

SSH tunneling encrypts traffic through an SSH connection. Local port forwarding (`ssh -L 8080:internal:80 user@gateway`) accesses internal services. Remote forwarding (`ssh -R 9000:localhost:3000 user@server`) exposes local services. Dynamic forwarding (`ssh -D 1080 user@server`) creates a SOCKS proxy for all traffic.

How do I harden my SSH server configuration?

In /etc/ssh/sshd_config: set PermitRootLogin no, PasswordAuthentication no, PubkeyAuthentication yes, change the default port from 22, add AllowUsers, set MaxAuthTries 3, and enable ClientAliveInterval. Restart with `sudo systemctl restart sshd`. See our [firewall guide](/learn/firewall-fundamentals) for additional hardening.

What is an SSH config file and why should I use one?

The ~/.ssh/config file defines connection presets so you can type `ssh webserver` instead of `ssh -i ~/.ssh/key -p 2222 admin@192.168.1.100`. Define Host entries with HostName, User, Port, and IdentityFile. This simplifies managing connections to multiple servers.

How do I transfer files securely with SSH?

Use SCP: `scp file.txt user@host:/path/` to copy to a server, or `scp user@host:/path/file.txt ./` to copy from. Use SFTP (`sftp user@host`) for interactive file management. For large transfers, rsync over SSH (`rsync -avz -e ssh ./dir user@host:/path/`) is more efficient.

What is the SSH known_hosts file?

The ~/.ssh/known_hosts file stores server public key fingerprints to verify server identity. On first connection, SSH asks to confirm the server fingerprint. If it changes, SSH warns of a potential man-in-the-middle attack. Remove stale entries with `ssh-keygen -R hostname`.

How do I use SSH agent to avoid typing my key passphrase?

Run `eval $(ssh-agent)` to start the agent, then `ssh-add ~/.ssh/id_ed25519` to load your key. The agent caches your decrypted key in memory. Use `ssh-add -l` to list loaded keys and `ssh-add -D` to clear them. Set AddKeysToAgent yes in your SSH config for automatic loading.

How do I set up SSH jump hosts for accessing internal servers?

Use `ssh -J bastion.example.com internal-server.local` to jump through a bastion host. In ~/.ssh/config, define: Host internal-server, ProxyJump bastion. This lets you reach servers behind firewalls without exposing them directly to the internet. See our [networking guide](/learn/linux-networking-basics) for network architecture details.

What port does SSH use and can I change it?

SSH uses port 22 by default. Changing it (e.g., to 2222) reduces automated brute-force attempts but is not real security — it's security through obscurity. Set Port 2222 in /etc/ssh/sshd_config and update your firewall rules. Always combine with key-based auth and fail2ban.

How do I set up fail2ban to protect SSH?

Install with `sudo apt install fail2ban`, configure /etc/fail2ban/jail.local to set maxretry=3 and bantime=3600 for SSH. Enable with `sudo systemctl enable --now fail2ban`. fail2ban monitors /var/log/auth.log and blocks IPs with too many failed login attempts using iptables rules.