Linux Essentials Preparation · lesson 21 of 23 · 25 min
SSH Fundamentals
SSH (Secure Shell) provides encrypted remote access to Linux systems. Uses TCP port 22. Replaces Telnet (unencrypted). The SSH daemon is sshd.
Password authentication — user provides username and password. Convenient but vulnerable to brute force attacks.
Key-based authentication — uses a cryptographic key pair: private key (kept secret on client) and public key (placed on server). More secure than passwords — immune to brute force.
Generating a key pair: ssh-keygen -t ed25519 -C "comment". Creates ~/.ssh/id_ed25519 (private) and ~/.ssh/id_ed25519.pub (public). Use ed25519 (modern) or RSA 4096-bit.
Copying public key to server: ssh-copy-id user@server — appends the public key to ~/.ssh/authorized_keys on the server.
Connecting: ssh user@hostname. ssh -p 2222 user@hostname for non-standard port. ssh -i ~/.ssh/mykey user@hostname to specify a key.
sshd_config Hardening
The SSH server configuration is in /etc/ssh/sshd_config. Key hardening settings:
PermitRootLogin no — disables direct root login via SSH. Use a regular user then sudo.
PasswordAuthentication no — disables password auth, requires key-based auth only.
Port 2222 — changes SSH from default port 22. Security through obscurity — reduces automated scans.
AllowUsers alice bob — only allows specific users to SSH in.
MaxAuthTries 3 — limits authentication attempts per connection.
ClientAliveInterval 300 — disconnects idle sessions after 5 minutes.
After editing sshd_config: systemctl restart sshd (or sshd -t to test config first).
SSH port forwarding: Local: ssh -L 8080:internal:80 user@jumphost — forwards local port 8080 to internal:80 through jumphost. Remote: ssh -R. Dynamic (SOCKS proxy): ssh -D 1080.
scp — secure copy over SSH. scp file.txt user@server:/path/. scp -r dir/ user@server:/path/ for directories.
sftp — interactive secure file transfer. sftp user@server. Commands: get, put, ls, cd, mkdir.
Exam Tip
Key hardening: PermitRootLogin no, PasswordAuthentication no. Public key goes in ~/.ssh/authorized_keys. ssh-keygen generates the key pair. scp copies files securely. Restart sshd after config changes.
Key Terms
Key Terms
Knowledge Check — 8 Questions
Linux Essentials — SSH
Key-based SSH authentication is more secure than passwords because:
- Keys are longer than passwords
- Keys are immune to brute force — the private key never leaves the client
- Keys are stored on the server
- Keys expire automatically
- Answer: Keys are immune to brute force — the private key never leaves the client
Key-based auth: the private key never leaves your machine. The server only has the public key. No password to brute force. The public key is placed on the server in:
- ~/.ssh/id_rsa
- ~/.ssh/known_hosts
- ~/.ssh/authorized_keys
- /etc/ssh/sshd_config
- Answer: ~/.ssh/authorized_keys
The server’s ~/.ssh/authorized_keys file contains public keys of clients allowed to authenticate. ssh-copy-id adds it automatically. PermitRootLogin no in sshd_config:
- Disables SSH entirely
- Prevents direct root login via SSH
- Disables password authentication
- Blocks all users
- Answer: Prevents direct root login via SSH
Best practice: disable root SSH login. Users SSH in as a regular user then use sudo for privileged commands. ssh-keygen -t ed25519 generates:
- An RSA key pair
- An Ed25519 key pair (modern, recommended)
- A password hash
- An SSL certificate
- Answer: An Ed25519 key pair (modern, recommended)
Ed25519 is the modern recommended SSH key type — smaller, faster, and more secure than RSA. Use over RSA when possible. scp -r dir/ user@server:/path/ copies:
- A single file
- A directory recursively
- Only hidden files
- Files matching a pattern
- Answer: A directory recursively
scp -r copies directories recursively — like cp -r but over SSH. Without -r, scp only copies individual files. After editing /etc/ssh/sshd_config, you must:
- Reboot the server
- Run systemctl restart sshd
- Log out and back in
- Run ssh-keygen
- Answer: Run systemctl restart sshd
sshd reads its config at startup. systemctl restart sshd reloads the config. Test first with sshd -t to catch syntax errors. SSH local port forwarding (ssh -L) is used to:
- Forward remote ports to the local machine
- Forward local ports to a remote service through the SSH tunnel
- Create a SOCKS proxy
- Copy files securely
- Answer: Forward local ports to a remote service through the SSH tunnel
ssh -L 8080:internal:80 user@jump: connects to local port 8080 which tunnels to internal:80 via the jump host.
The SSH daemon configuration file is located at /etc/ssh/_____.
Answer: sshd_config
/etc/ssh/sshd_config is the SSH server configuration. /etc/ssh/ssh_config is the client configuration.
Previous lesson: File permissions and security: chmod, chown, SUID/SGID/sticky bit, SSH hardening, ufw, Fail2ban
Back to Linux Essentials Preparation
Next lesson: Firewall management: ufw, firewalld, iptables basics — rules, chains, policies