Linux · sockets & transfer

ssh

a shell on another machine

ssh — secure shell — logs you in to a remote host over an encrypted connection. Everything you type and everything that comes back is protected, and the server proves its identity to you before you prove yours to it. It is how servers are administered.

ssh user@host — and from then on, your terminal is that machine’s.

Form

ssh user@host

port 22 unless -p

Key or password

keys are stronger

One command

ssh host "cmd"

runs and returns

Leave

exit

or Ctrl+D

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashopenssh-client

$ ssh deploy@192.0.2.10

1The authenticity of host '192.0.2.10 (192.0.2.10)' can't be established.

ED25519 key fingerprint is SHA256:7Kq2nV0xJm4cP9rT1sYbA6dLwE3hZ8uFoGiN5tQpXyM.

2Are you sure you want to continue connecting (yes/no/[fingerprint])? yes

Warning: Permanently added '192.0.2.10' (ED25519) to the list of known hosts.

3deploy@192.0.2.10's password:

4deploy@web01:~$ hostname

web01

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

A host seen for the first time

ssh has no record of this server, so it shows the fingerprint of the server’s key and asks you to confirm.

Saying yes records the key

It is saved in ~/.ssh/known_hosts. On every later connection the server must present the same key, or ssh refuses loudly.

Now you prove who you are

With a password here; with a key, this prompt does not appear.

The prompt has changed

You are on web01 as deploy. Commands now run there, until you type exit.

Switches

A switch changes how the command behaves. These are the ones used day to day; man ssh lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-p PORT: Connect to this port instead of 22.
-i FILE: Use this private key.
-v: Verbose: show each step of the connection. Essential for debugging.
-L L:HOST:R: Forward local port L to HOST port R through the server.
-D PORT: Open a SOCKS proxy on a local port.
-J HOST: Jump through an intermediate host.
-N: Do not run a remote command — for forwarding only.
-X: Forward graphical (X11) programs.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

ssh -p 2222 deploy@192.0.2.10

Connects to a server listening on another port.

ssh deploy@192.0.2.10 "df -h /"

Runs one command remotely and prints its output locally.

ssh -i ~/.ssh/work_key deploy@192.0.2.10

Uses a particular private key.

ssh -L 8080:localhost:80 deploy@192.0.2.10

Forwards local port 8080 to port 80 on the server, through the encrypted connection.

In cybersecurity

SSH is the front door of every server, and the most attacked service on the internet.

Use keys, turn passwords off

Set "PasswordAuthentication no" and "PermitRootLogin no" in sshd_config once key login works. Password guessing then cannot succeed.

Take the host key warning seriously

"REMOTE HOST IDENTIFICATION HAS CHANGED" means the server’s key differs from the one you saved: a rebuilt server, or someone in the middle. Find out which before continuing.

Forwarding crosses boundaries

-L, -R and -D carry other traffic through the SSH connection, straight past a firewall. Useful, and exactly why it should be restricted on bastion hosts.

Protocols it shows

SSH TCP

Read alongside

scpCopies files between machines over SSH, with the same syntax as cp plus a host name.ssh-keygenCreates an SSH key pair: a private key that stays with you, and a public key that servers use to recognise you.