Working with SSH and Remote Access
1. Connecting to Remote Host
| Option | Values | Description |
|---|---|---|
| ssh user@hostname | ssh john@example.com |
Connect to a remote host as a specific user |
| ssh -p port user@hostname | ssh -p 2222 john@example.com |
Connect to a remote host on a specific port |
| ssh -i keyfile user@hostname | ssh -i ~/.ssh/id_rsa john@example.com |
Use a specific private key for authentication |
2. Using SSH with Custom Port
| Option | Values | Notes |
|---|---|---|
| Port | 22 |
Default SSH port |
| Custom Port | 2222 |
Alternative port for SSH connection |
Note: Ensure the custom port is open in the firewall and allowed by the SSH server configuration.
3. Copying Files with SCP
| Option | Values | Description |
|---|---|---|
| scp [source] [destination] | scp file.txt user@host:/path/ |
Copy files between local and remote systems |
| scp -r | scp -r /local/dir user@host:/remote/dir |
Copy directories recursively |
| scp -P | scp -P 2222 file.txt user@host:/path/ |
Specify alternate SSH port |
| scp -v | scp -v file.txt user@host:/path/ |
Verbose output for debugging |
Example: Copying a file to a remote server
scp /home/user/document.pdf admin@192.168.1.100:/home/admin/documents/Example: Copying a directory recursively
scp -r /home/user/project/ user@remote-server:/home/user/projects/
Note: Ensure SSH keys are set up for passwordless authentication to avoid repeated prompts.
4. Synchronizing Files with rsync
rsync is a powerful utility for synchronizing files and directories between local and remote systems. It's commonly used for backups, mirroring, and efficient file transfers.
| Option | Values | Description |
|---|---|---|
| -a | --archive |
Archive mode: preserves permissions, timestamps, symbolic links, etc. |
| -v | --verbose |
Verbose output to show progress and details. |
| -z | --compress |
Compress data during transfer to reduce bandwidth usage. |
| -r | --recursive |
Recursively sync subdirectories. |
| -n | --dry-run |
Simulate the sync without actually making changes. |
| -e | --rsh |
Specify the remote shell to use (e.g., ssh). |
| --delete | Delete files in destination that don't exist in source. |
Note:
rsync uses a delta-sync algorithm to transfer only the differences between files, making it efficient for large datasets.
5. Generating SSH Keys
| Key Type | Description | Security Level | Usage |
|---|---|---|---|
| RSA | Traditional asymmetric key algorithm | 2048-bit minimum recommended | General-purpose SSH access |
| ECDSA | Elliptic Curve Digital Signature Algorithm | 256-bit (NIST P-256) or higher | Modern systems with curve support |
| Ed25519 | Elliptic Curve with Edwards curve | 256-bit security | Highly secure, fast performance |
Note: The
-C flag adds a comment (typically email address) to identify the key.
Warning: Never share your private key or commit it to version control.
Key Generation Best Practices
- Use
Ed25519orECDSAfor new setups - Use at least 2048-bit RSA keys (4096-bit preferred)
- Protect private keys with passphrases
- Store keys securely and backup the private key
6. Copying Public Key
| Command | Description | Notes |
|---|---|---|
| ssh-copy-id | ssh-copy-id [-i [key]] user@host |
Copies the public key to the remote host's ~/.ssh/authorized_keys file |
Note: The
ssh-copy-id command will prompt for the user's password on the remote host if the key is not already present.7. Configuring SSH Client
| Configuration File | Location | Description |
|---|---|---|
| ~/.ssh/config | ~/.ssh/config |
Per-user SSH client configuration file |
| /etc/ssh/ssh_config | /etc/ssh/ssh_config |
System-wide SSH client configuration file |
Example: Basic SSH Client Configuration
Host github.com
HostName github.com
User git
IdentityFile ~/.ssh/id_rsa_github
IdentitiesOnly yes
Host server1
HostName 192.168.1.100
User admin
Port 2222
IdentityFile ~/.ssh/id_rsa_server1
Example: SSH Client with ProxyJump
Host jump-server
HostName 10.0.0.1
User jumpuser
Host internal-server
HostName 192.168.1.50
User admin
ProxyJump jump-server
| Directive | Description | Values |
|---|---|---|
| Host | Name used to identify the host in config | String |
| HostName | Actual hostname or IP address to connect to | String |
| User | User to log in as on remote host | String |
| Port | SSH port to connect to | Integer (1-65535) |
| IdentityFile | Private key file for authentication | Path to private key |
| IdentitiesOnly | Use only keys specified in config | yes or no |
| ProxyJump | Intermediate host to connect through | Host alias or address |
| ServerAliveInterval | Seconds between keep-alive packets | Integer |
| StrictHostKeyChecking | Whether to check host keys | yes, no, or ask |
Note: The
ProxyJump directive requires OpenSSH 7.3 or later.
Warning: Ensure
IdentityFile permissions are set to 600 for security.
8. Configuring SSH Server
| Configuration File | Path | Description |
|---|---|---|
| /etc/ssh/sshd_config | /etc/ssh/sshd_config |
Main configuration file for the SSH daemon |
Example: Basic SSH Server Configuration
# Listen on port 22
Port 22
# Use SSH protocol version 2 only
Protocol 2
# Disable root login
PermitRootLogin no
# Allow password authentication (optional)
PasswordAuthentication yes
# Disable X11 forwarding
X11Forwarding no
# Set the login grace time (seconds)
LoginGraceTime 60
# Define allowed authentication methods
AuthenticationMethods publickey,password
# Set the maximum number of concurrent sessions
MaxSessions 10
# Define allowed key exchange algorithms
KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha256
# Define allowed cipher algorithms
Ciphers aes128-ctr,aes256-ctr
# Define allowed MAC algorithms
MACs hmac-sha2-256,hmac-sha2-512
# Define allowed host key algorithms
HostKeyAlgorithms ssh-rsa,ssh-ed25519
# Define allowed public key algorithms
PubkeyAcceptedKeyTypes ssh-rsa,ssh-ed25519
Note: After modifying
/etc/ssh/sshd_config, restart the SSH service using sudo systemctl restart sshd or sudo service ssh restart.
Warning: Disabling root login (
PermitRootLogin no) is highly recommended for security reasons.
Key SSH Server Configuration Options
- Port: Specifies the port on which SSH listens (default is 22).
- Protocol: Sets the SSH protocol version to use (version 2 is recommended).
- PermitRootLogin: Controls whether root login is allowed (recommended to disable).
- PasswordAuthentication: Enables or disables password-based authentication.
- X11Forwarding: Controls X11 forwarding capability (disable for security).
- LoginGraceTime: Sets the time (in seconds) allowed for login before disconnecting.
- MaxSessions: Limits the number of concurrent sessions per user.
- KexAlgorithms: Specifies key exchange algorithms for secure connections.
- Ciphers: Defines the encryption algorithms used for data transfer.
- MACs: Specifies message authentication codes to ensure data integrity.
- HostKeyAlgorithms: Sets the host key algorithms supported by the server.
- PubkeyAcceptedKeyTypes: Determines which public key types are accepted for authentication.
9. Creating SSH Tunnels
| Option | Values | Description |
|---|---|---|
| -L | local_port:remote_host:remote_port |
Local port forwarding |
| -R | remote_port:local_host:local_port |
Remote port forwarding |
| -D | local_port |
Dynamically allocate a port for SOCKS proxy |
Note: Tunnels are useful for securely accessing services that are not exposed to the public internet.
10. Managing SSH Agent
| Command | Description | Notes |
|---|---|---|
| ssh-agent | Starts a new SSH agent | Displays the agent's PID and socket path |
| ssh-add | Adds private keys to the SSH agent | Can add multiple keys at once |
| ssh-add -l | List loaded keys in the SSH agent | Shows fingerprint and key type |
| ssh-add -D | Remove all keys from the SSH agent | Clears all loaded keys |
| ssh-add -R <key> | Remove a specific key from the agent | Requires the full path to the key |
Example: Start SSH Agent and Add Key
# Start the SSH agent
eval "$(ssh-agent -s)"
# Add your private key to the agent
ssh-add ~/.ssh/id_rsa
Note: The
ssh-agent must be started in a shell session where you intend to use the keys. If using a terminal multiplexer like tmux, ensure it's started in the same session.
Warning: Keys added to the SSH agent remain in memory until the agent is stopped or the keys are removed. Ensure secure handling of sessions to prevent unauthorized access.
11. Using ProxyJump
ProxyJump is a powerful SSH feature that allows you to connect to a target host through an intermediate jump host. This is particularly useful in environments where direct access to the target host is restricted.
| Directive | Description | Example |
|---|---|---|
| ProxyJump | Specifies the intermediate host to connect through | ProxyJump user@jump-host |
Example: SSH through a jump host
ssh -J user@jump-host user@target-server</code>
</pre>
</div>
</div>
<div class="example">
<h2 id="example-using-proxyjump-in-ssh-config">Example: Using ProxyJump in SSH config<a href="#example-using-proxyjump-in-ssh-config" class="toc__headingLink" aria-label="Link to this section"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71"></path><path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"></path></svg></a></h2>
<div class="codeBlock" data-language="bash">
<pre><code>Host jump-host
HostName jump.example.com
User user
Host target-server
HostName target.example.com
User user
ProxyJump jump-host</code>
</pre>
</div>
</div>
<div class="note">
<strong>Note:</strong> The <code>-J</code> flag is a shorthand for <code>ProxyJump</code>. It allows you to specify the jump host directly on the command line.
</div>
<div class="warning">
<strong>Warning:</strong> Ensure that the jump host is trusted, as it has access to your session and can potentially log or intercept data.
</div>
<h2 id="12-multiplexing-connections">12. Multiplexing Connections<a href="#12-multiplexing-connections" class="toc__headingLink" aria-label="Link to this section"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71"></path><path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"></path></svg></a></h2>
<p>SSH multiplexing allows multiple SSH sessions to share a single network connection, improving performance and reducing resource usage.</p>
<table>
<tbody>
<tr>
<th>Option</th>
<th>Values</th>
<th>Description</th>
</tr>
<tr>
<td class="property">ControlMaster</td>
<td><code>auto</code></td>
<td>Enables connection sharing. Set to <code>yes</code> to always share, <code>auto</code> to share only when appropriate.</td>
</tr>
<tr>
<td class="property">ControlPath</td>
<td><code>~/.ssh/sockets/%r@%h:%p</code></td>
<td>Path to the control socket used for sharing. Must be unique per host and port.</td>
</tr>
<tr>
<td class="property">ControlPersist</td>
<td><code>10m</code></td>
<td>Keep the connection alive for 10 minutes after the last client disconnects. Set to <code>yes</code> for indefinite.</td>
</tr>
</tbody>
</table>
<div class="example">
<h2 id="example-configuring-ssh-multiplexing">Example: Configuring SSH Multiplexing<a href="#example-configuring-ssh-multiplexing" class="toc__headingLink" aria-label="Link to this section"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71"></path><path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"></path></svg></a></h2>
<div class="codeBlock" data-language="bash">
<pre><code>Host example.com
HostName example.com
User john
ControlMaster auto
ControlPath ~/.ssh/sockets/%r@%h:%p
ControlPersist 10m
Note: The
ControlPath must be unique per host and port to prevent conflicts.
Warning: Ensure the directory for
ControlPath exists and has appropriate permissions to avoid connection errors.