🔑 SSH & Remote Access

What is SSH?

SSH (Secure Shell) provides encrypted remote access to Linux systems:

• Run commands on remote servers
• Transfer files securely
• Create encrypted tunnels
• No passwords visible on the network

---

Basic SSH Connection

ssh user@hostname           # Connect to remote server
ssh alice@192.168.1.100     # Connect with username and IP
ssh alice@server.example.com  # Connect with domain name
ssh -p 2222 user@host       # Non-standard port

First connection, you’ll see:

The authenticity of host 'server (192.168.1.100)' can't be established.
ED25519 key fingerprint is SHA256:abcd1234...
Are you sure you want to continue connecting (yes/no)?

Type yes to add the server to known hosts.

---

SSH Key Authentication

Passwords are weak. Keys are better:

1. Private key: Stays on your computer (NEVER share!)
2. Public key: Goes on servers you want to access

Generate SSH Key Pair

ssh-keygen -t ed25519 -C "your_email@example.com"
# or for older systems:
ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

Follow prompts:

• Location: ~/.ssh/id_ed25519 (default)
• Passphrase: Optional but recommended

Copy Public Key to Server

ssh-copy-id user@server     # Easiest method
# or manually:
cat ~/.ssh/id_ed25519.pub | ssh user@server "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Now you can log in without a password!

---

SSH Config File

Create ~/.ssh/config for shortcuts:

Host myserver
    HostName 192.168.1.100
    User alice
    Port 22
    IdentityFile ~/.ssh/id_ed25519

Host work
    HostName work.example.com
    User alice
    ProxyJump jump.example.com

Now just:

ssh myserver                # Uses config settings
ssh work                    # Jumps through proxy

---

SSH Key Agent

The agent remembers your key passphrase:

# Start agent
eval "$(ssh-agent -s)"

# Add key
ssh-add ~/.ssh/id_ed25519

# List loaded keys
ssh-add -l

# Remove all keys
ssh-add -D

Add to ~/.bashrc to auto-start:

eval "$(ssh-agent -s)" > /dev/null
ssh-add ~/.ssh/id_ed25519 2> /dev/null

---

Copying Files with SCP/SFTP

scp — Secure Copy

scp file.txt user@server:/path/to/destination/
scp user@server:/remote/file.txt /local/path/
scp -r directory/ user@server:/path/    # Copy directory

sftp — Interactive File Transfer

sftp user@server
# Then use: get, put, ls, cd, lcd, mkdir

rsync — Efficient Sync

rsync -avz local/ user@server:/remote/   # Sync directories
rsync -avz --delete local/ user@server:/remote/  # Mirror (delete extra)

---

Security Best Practices

1. Disable Password Authentication

On server, edit /etc/ssh/sshd_config:

PasswordAuthentication no

2. Use Non-Standard Port

Port 2222

3. Limit Users

AllowUsers alice bob

4. Key Permissions

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub
chmod 600 ~/.ssh/authorized_keys

---

Try It!

Practice SSH in the terminal:

Exercises:

1. Generate a key pair: ssh-keygen -t ed25519
2. View your public key: cat ~/.ssh/id_ed25519.pub
3. Check key permissions: ls -la ~/.ssh/

Try it in the terminal

A sandboxed shell with this lesson’s commands. Type help to see what’s available.