SSH Mastery 2026: From Zero to Hero - The Developer's Complete Guide

┌─────────────┐                              ┌─────────────┐
│             │      Encrypted Channel       │             │
│  SSH Client │◄────────────────────────────►│  SSH Server │
│ (Your PC)   │      Port 22 (default)       │ (Remote)    │
│             │                              │             │
└─────────────┘                              └─────────────┘
      │                                             │
      │ 1. Client initiates connection             │
      │────────────────────────────────────────────►│
      │                                             │
      │ 2. Server sends public host key            │
      │◄────────────────────────────────────────────│
      │                                             │
      │ 3. Secure connection established           │
      │ 4. User authentication (key/password)      │
      │────────────────────────────────────────────►│
      │                                             │
      │ 5. Encrypted session begins                │
      │◄────────────────────────────────────────────│

# Check if SSH client is installed
which ssh

# Check if SSH server is installed (Linux)
which sshd

# Install OpenSSH client (Ubuntu/Debian)
sudo apt update
sudo apt install openssh-client

# Install OpenSSH server (Ubuntu/Debian)
sudo apt install openssh-server

# Install on macOS (if needed)
brew install openssh

ssh username@hostname_or_ip

# Examples
ssh rafi@192.168.1.100
ssh admin@example.com
ssh [email protected]

$ ssh user@remote-server.com

The authenticity of host 'remote-server.com (203.0.113.10)' can't be established.
ED25519 key fingerprint is SHA256:Xk1pJ7+3vYr6...
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes

Warning: Permanently added 'remote-server.com' (ED25519) to the list of known hosts.
user@remote-server.com's password:

# View your known hosts
cat ~/.ssh/known_hosts

# Remove a specific host (if key changed legitimately)
ssh-keygen -R hostname_or_ip

# Example
ssh-keygen -R 192.168.1.100

# Connect with specific username
ssh user@host

# Connect with custom port
ssh -p 2222 user@host

# Execute single command remotely
ssh user@host 'ls -la /var/log'

# Copy files (SCP - Secure Copy)
scp file.txt user@host:/path/to/destination
scp user@host:/remote/file.txt /local/path/

# Copy directories recursively
scp -r directory/ user@host:/path/

# Modern alternative to SCP (faster, resumable)
rsync -avz -e ssh directory/ user@host:/path/

# Create config file
touch ~/.ssh/config
chmod 600 ~/.ssh/config

# Edit with your favorite editor
nano ~/.ssh/config

# Personal Server
Host myserver
    HostName 192.168.1.100
    User rafi
    Port 22

# Work VPS
Host work
    HostName work.example.com
    User admin
    Port 2222

# Instead of: ssh -p 2222 admin@work.example.com
# Simply use:
ssh work

┌──────────────────┐                    ┌──────────────────┐
│   SSH Client     │                    │   SSH Server     │
├──────────────────┤                    ├──────────────────┤
│  Private Key     │                    │  Public Key      │
│  (id_ed25519)    │                    │  (authorized_    │
│  KEEP SECRET!    │                    │   keys)          │
└────────┬─────────┘                    └────────┬─────────┘
         │                                       │
         │  1. Client: "I want to connect"      │
         │──────────────────────────────────────►│
         │                                       │
         │  2. Server: "Prove you have the key" │
         │◄──────────────────────────────────────│
         │                                       │
         │  3. Client signs challenge with      │
         │     private key                       │
         │──────────────────────────────────────►│
         │                                       │
         │  4. Server verifies with public key  │
         │  5. Connection granted! ✓            │
         │◄──────────────────────────────────────│

# Generate Ed25519 key (RECOMMENDED)
ssh-keygen -t ed25519 -a 100 -C "[email protected]"

# Explanation:
# -t ed25519       : Key type (Ed25519 algorithm)
# -a 100           : Number of KDF rounds (key derivation, more = slower brute force)
# -C "comment"     : Meaningful comment (identifies key purpose/owner)

# You'll be prompted for:
# 1. File location (default: ~/.ssh/id_ed25519)
# 2. Passphrase (HIGHLY RECOMMENDED - adds encryption layer)

# Generate RSA key (minimum 3072-bit, 4096 recommended)
ssh-keygen -t rsa -b 4096 -C "[email protected]"

# NEVER use RSA keys smaller than 3072 bits in 2026

# Ed25519 with year embedding
ssh-keygen -t ed25519 -a 100 -C "rafi@company-2026-01" \
    -f ~/.ssh/id_ed25519_2026

# When 2028 comes, rotate to new key:
ssh-keygen -t ed25519 -a 100 -C "rafi@company-2028-01" \
    -f ~/.ssh/id_ed25519_2028

# List your SSH keys
ls -la ~/.ssh/

# Typical structure:
~/.ssh/
├── id_ed25519          # Private key (NEVER SHARE!)
├── id_ed25519.pub      # Public key (share freely)
├── config              # Connection configurations
├── known_hosts         # Server fingerprints
└── authorized_keys     # Public keys allowed to connect (on servers)

# Correct permissions (REQUIRED for security)
chmod 700 ~/.ssh                    # Directory
chmod 600 ~/.ssh/id_ed25519         # Private keys
chmod 644 ~/.ssh/id_ed25519.pub     # Public keys
chmod 600 ~/.ssh/config             # Config file
chmod 600 ~/.ssh/authorized_keys    # Authorized keys

# Why? SSH refuses to work with incorrect permissions as a security measure!

# Copy public key to remote server
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@remote-server

# For custom port
ssh-copy-id -i ~/.ssh/id_ed25519.pub -p 2222 user@remote-server

# What it does:
# 1. Connects to remote server (requires password this once)
# 2. Appends public key to ~/.ssh/authorized_keys
# 3. Sets correct permissions

# Display your public key
cat ~/.ssh/id_ed25519.pub

# Example output:
# ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBr... rafi@company-2026-01

# On remote server, append to authorized_keys:
echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBr... rafi@company-2026-01" \
    >> ~/.ssh/authorized_keys

# Set permissions
chmod 600 ~/.ssh/authorized_keys

cat ~/.ssh/id_ed25519.pub | ssh user@remote \
    'mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys'

# Test connection (should NOT ask for password)
ssh user@remote-server

# Verify which key is being used
ssh -v user@remote-server 2>&1 | grep "identity file"

# Output shows:
# debug1: identity file /home/user/.ssh/id_ed25519 type 4

# Start SSH agent
eval "$(ssh-agent -s)"

# Add key to agent
ssh-add ~/.ssh/id_ed25519

# Enter passphrase once - agent remembers for session

# List loaded keys
ssh-add -l

# Remove all keys from agent
ssh-add -D

# Auto-load keys on login (add to ~/.bashrc or ~/.zshrc)
if [ -z "$SSH_AUTH_SOCK" ]; then
    eval "$(ssh-agent -s)"
    ssh-add ~/.ssh/id_ed25519
fi

# Add key to macOS Keychain (survives reboots)
ssh-add --apple-use-keychain ~/.ssh/id_ed25519

# Auto-load from Keychain (add to ~/.ssh/config)
Host *
    AddKeysToAgent yes
    UseKeychain yes
    IdentityFile ~/.ssh/id_ed25519

# Global defaults for all hosts
Host *
    ServerAliveInterval 60
    ServerAliveCountMax 3
    Compression yes
    ControlMaster auto
    ControlPath ~/.ssh/control-%r@%h:%p
    ControlPersist 10m

# Production server with specific key
Host prod
    HostName prod.example.com
    User deploy
    Port 2222
    IdentityFile ~/.ssh/id_ed25519_prod
    ForwardAgent no

# Development server with agent forwarding
Host dev
    HostName dev.example.com
    User developer
    IdentityFile ~/.ssh/id_ed25519
    ForwardAgent yes

# Bastion/Jump host configuration
Host internal-server
    HostName 10.0.1.100
    User admin
    ProxyJump bastion

Host bastion
    HostName bastion.example.com
    User admin
    Port 2222

# AWS EC2 instance
Host aws-web
    HostName ec2-54-123-45-67.compute.amazonaws.com
    User ec2-user
    IdentityFile ~/.ssh/aws-key.pem

# Multiple hostnames for same config
Host web1 web2 web3
    HostName %h.example.com
    User webadmin
    IdentityFile ~/.ssh/id_ed25519_web

# Wildcard matching
Host *.internal
    User admin
    IdentityFile ~/.ssh/id_ed25519_internal
    ProxyJump gateway

# First connection establishes control socket
ssh server1

# Subsequent connections (instant, no re-authentication!)
ssh server1  # Uses existing connection
scp file.txt server1:/path/  # Uses existing connection

Host speedyserver
    HostName example.com
    User admin
    ControlMaster auto
    ControlPath ~/.ssh/control-%r@%h:%p
    ControlPersist 10m

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup
sudo nano /etc/ssh/sshd_config

# /etc/ssh/sshd_config - 2026 Security Hardened Configuration

# === Basic Settings ===
Port 2222                              # Change from default 22 (reduces automated attacks)
Protocol 2                             # Only use Protocol 2 (Protocol 1 is deprecated)
PermitRootLogin no                     # NEVER allow direct root login
MaxAuthTries 3                         # Limit authentication attempts
MaxSessions 5                          # Limit concurrent sessions

# === Authentication ===
PubkeyAuthentication yes               # Enable public key authentication
PasswordAuthentication no              # Disable password authentication (KEY-BASED ONLY)
PermitEmptyPasswords no                # Never allow empty passwords
ChallengeResponseAuthentication no     # Disable challenge-response
UsePAM no                              # Disable PAM if using key-only auth

# === Authorized Keys ===
AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2

# === Restrict Users/Groups ===
AllowUsers deploy webadmin admin       # Only these users can SSH
# AllowGroups sshusers                 # Alternative: restrict by group
# DenyUsers baduser                    # Explicitly deny users
# DenyGroups nogroupssh                # Explicitly deny groups

# === Timeout & Keepalive ===
ClientAliveInterval 300                # Send keepalive every 5 minutes
ClientAliveCountMax 0                  # Disconnect if client unresponsive
LoginGraceTime 60                      # 60 seconds to complete authentication

# === Logging ===
SyslogFacility AUTH                    # Use AUTH facility for logging
LogLevel VERBOSE                       # Detailed logging for security auditing

# === Cryptographic Settings (2026 Hardened) ===
# Only allow modern, secure algorithms

# Key Exchange Algorithms (KEX)
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256

# Host Key Algorithms
HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256

# Ciphers (Encryption)
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com

# MACs (Message Authentication Codes)
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

# === Disable Unnecessary Features ===
X11Forwarding no                       # Disable X11 forwarding (unless needed)
PermitUserEnvironment no               # Don't allow users to set environment options
AllowAgentForwarding no                # Disable agent forwarding (enable per-user if needed)
AllowTcpForwarding no                  # Disable TCP forwarding (enable if needed for tunneling)
PermitTunnel no                        # Disable TUN/TAP device forwarding
GatewayPorts no                        # Don't allow remote hosts to connect to forwarded ports

# === Banner (Optional) ===
Banner /etc/ssh/banner.txt             # Display warning banner (legal notice)

# === Subsystems ===
Subsystem sftp /usr/lib/openssh/sftp-server  # SFTP subsystem (for file transfers)

# === Additional Security ===
PrintMotd no                           # Don't print message of the day
PrintLastLog yes                       # Show last login info
TCPKeepAlive no                        # Don't use TCP keepalive (use ClientAlive instead)
Compression no                         # Disable compression (prevents CRIME-style attacks)

# Test configuration syntax
sudo sshd -t

# If no errors, restart SSH service
sudo systemctl restart sshd

# Check service status
sudo systemctl status sshd

# IMPORTANT: Keep your current SSH session open while testing!
# Open a NEW terminal to test connection before closing original session

# Ubuntu/Debian
sudo apt install libpam-google-authenticator

# CentOS/RHEL
sudo yum install google-authenticator

# As the user who needs 2FA
google-authenticator

# Answer the prompts:
# 1. Time-based tokens? Yes
# 2. Update .google_authenticator file? Yes
# 3. Disallow multiple uses? Yes
# 4. Increase time window? No
# 5. Enable rate-limiting? Yes

# Scan QR code with authenticator app (Google Authenticator, Authy, 1Password)

# Edit PAM configuration
sudo nano /etc/pam.d/sshd

# Add this line at the top:
auth required pam_google_authenticator.so

# Edit SSH configuration
sudo nano /etc/ssh/sshd_config

# Set these options:
ChallengeResponseAuthentication yes
UsePAM yes

# For key + 2FA (most secure):
AuthenticationMethods publickey,keyboard-interactive

# Restart SSH
sudo systemctl restart sshd

# Enable UFW
sudo ufw enable

# Allow SSH on custom port from specific IP
sudo ufw allow from 203.0.113.10 to any port 2222

# Allow from subnet
sudo ufw allow from 192.168.1.0/24 to any port 2222

# Check rules
sudo ufw status numbered

# Delete rule by number
sudo ufw delete 2

# Add custom SSH port
sudo firewall-cmd --permanent --add-port=2222/tcp

# Allow from specific IP
sudo firewall-cmd --permanent --add-rich-rule='
  rule family="ipv4"
  source address="203.0.113.10"
  port protocol="tcp" port="2222" accept'

# Reload firewall
sudo firewall-cmd --reload

# List rules
sudo firewall-cmd --list-all

# Install Fail2Ban
sudo apt install fail2ban

# Create local configuration
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

[sshd]
enabled = true
port = 2222              # Your custom SSH port
filter = sshd
logpath = /var/log/auth.log
maxretry = 3             # Ban after 3 failed attempts
bantime = 3600           # Ban for 1 hour
findtime = 600           # Within 10 minutes

# Start and enable Fail2Ban
sudo systemctl start fail2ban
sudo systemctl enable fail2ban

# Check status
sudo fail2ban-client status sshd

# Unban IP
sudo fail2ban-client set sshd unbanip 203.0.113.10

# Generate new key with year identifier
ssh-keygen -t ed25519 -a 100 -C "rafi@company-2026" \
    -f ~/.ssh/id_ed25519_2026

# Deploy new key to all servers
for server in prod1 prod2 dev1 dev2; do
    ssh-copy-id -i ~/.ssh/id_ed25519_2026.pub $server
done

# Test new key on all servers
for server in prod1 prod2 dev1 dev2; do
    ssh -i ~/.ssh/id_ed25519_2026 $server "echo Connected to \$(hostname)"
done

# Update SSH config to use new key
sed -i 's/id_ed25519_2025/id_ed25519_2026/g' ~/.ssh/config

# After verification period (1 week), remove old keys from servers
for server in prod1 prod2 dev1 dev2; do
    ssh $server "sed -i '/rafi@company-2025/d' ~/.ssh/authorized_keys"
done

# Archive old key (don't delete immediately - keep for recovery)
mv ~/.ssh/id_ed25519_2025 ~/.ssh/archive/
mv ~/.ssh/id_ed25519_2025.pub ~/.ssh/archive/

# Recent successful logins
sudo last -a | head -20

# Failed login attempts (Debian/Ubuntu)
sudo grep "Failed password" /var/log/auth.log | tail -20

# Failed login attempts (CentOS/RHEL)
sudo grep "Failed password" /var/log/secure | tail -20

# Current SSH sessions
who
w

# Active SSH connections
sudo ss -tnp | grep sshd

# Install ssh-audit
pip install ssh-audit --break-system-packages

# Audit your SSH server
ssh-audit localhost

# Audit remote server
ssh-audit example.com -p 2222

# Output shows:
# - Weak algorithms
# - Recommended configurations
# - CVE vulnerabilities

ssh -L [local_address:]local_port:destination_address:destination_port user@ssh_server

┌─────────────────┐         SSH Tunnel          ┌─────────────┐
│   Your Laptop   │──────────────────────────────►│ SSH Server  │
│  (Client)       │  Encrypted Connection        │             │
└────────┬────────┘                              └──────┬──────┘
         │                                              │
         │ localhost:5432                               │
         │ ▼                                            │ 10.0.1.50:5432
    ┌────▼─────┐                                   ┌────▼─────┐
    │ Local    │  Traffic forwarded through   ────►│ Database │
    │ App      │  encrypted SSH tunnel              │ Server   │
    └──────────┘                                   └──────────┘

# Forward local port 5432 to remote PostgreSQL server
ssh -L 5432:localhost:5432 user@database-server

# Now connect locally
psql -h localhost -p 5432 -U dbuser

# The connection is encrypted and travels through SSH tunnel

# Access internal web app on port 80
ssh -L 8080:internal-web.company.local:80 user@bastion-host

# Open browser to http://localhost:8080
# You're now accessing internal-web.company.local securely!

# Forward multiple services simultaneously
ssh -L 5432:db.internal:5432 \
    -L 6379:redis.internal:6379 \
    -L 9200:elasticsearch.internal:9200 \
    user@jump-server

# Access:
# - PostgreSQL: localhost:5432
# - Redis: localhost:6379
# - Elasticsearch: localhost:9200

# SSH server acts as intermediary to reach external service
ssh -L 3306:external-db.example.com:3306 user@proxy-server

# Useful when direct access is blocked but proxy-server can reach it

ssh -R [remote_address:]remote_port:local_address:local_port user@ssh_server

┌─────────────────┐         SSH Tunnel          ┌─────────────┐
│   Your Laptop   │◄─────────────────────────────│ SSH Server  │
│  (Client)       │  Encrypted Connection        │             │
└────────┬────────┘                              └──────┬──────┘
         │                                              │
         │ localhost:8000                               │ 0.0.0.0:8080
    ┌────▼─────┐                                   ┌────▼─────┐
    │ Local    │  ◄──── Traffic forwarded ─────────│ External │
    │ Web App  │        through tunnel             │ Clients  │
    └──────────┘                                   └──────────┘

# Share your local dev server with team
ssh -R 8080:localhost:3000 user@public-server

# Team accesses: http://public-server:8080
# Traffic reaches your localhost:3000

# Stripe/PayPal needs to send webhooks to your app
ssh -R 9000:localhost:8000 user@my-public-vps.com

# Configure webhook URL: http://my-public-vps.com:9000/webhook
# Webhooks now reach your local development server!

# Access home server from anywhere
ssh -R 2222:home-server:22 user@public-vps

# From anywhere:
ssh -p 2222 user@public-vps
# You're now connected to your home server!

# Expose internal Jenkins to external contractors
ssh -R 0.0.0.0:8080:jenkins.internal:8080 user@public-server

# Contractors access: http://public-server:8080
# 0.0.0.0 allows all interfaces (default is localhost only)

# Server configuration to allow GatewayPorts
# /etc/ssh/sshd_config
GatewayPorts yes  # Allow binding to non-localhost addresses

# Or restrict to specific interfaces:
GatewayPorts clientspecified

ssh -D [local_address:]local_port user@ssh_server

┌─────────────────┐         SSH Tunnel          ┌─────────────┐
│   Your Laptop   │──────────────────────────────►│ SSH Server  │
│                 │  SOCKS5 Proxy Protocol       │             │
└────────┬────────┘                              └──────┬──────┘
         │                                              │
    localhost:1080                                      │
         │                                              │
    ┌────▼──────────────────┐                          │
    │  SOCKS-aware Apps:    │                          │
    │  - Firefox            │    All traffic routed────┼──►Internet
    │  - Chrome             │    through SSH server    │
    │  - curl --socks5      │                          │
    │  - proxychains        │                          │
    └───────────────────────┘                          │

# Create SOCKS proxy through trusted server
ssh -D 1080 user@trusted-server

# Configure browser:
# Firefox: Settings → Network → SOCKS Host: localhost, Port: 1080
# All browser traffic now encrypted through SSH tunnel

# SSH to server in different country
ssh -D 1080 user@server-in-target-country

# Browser traffic appears to originate from that country

# Establish SOCKS proxy through compromised host
ssh -D 1080 user@compromised-internal-host

# Use proxychains to scan internal network
proxychains nmap -sT 10.0.1.0/24

# All Nmap traffic routes through compromised host

# Start SOCKS proxy
ssh -D 1080 -C -N user@ssh-server

# Flags:
# -C: Enable compression
# -N: Don't execute remote command (just forwarding)

# Use with various applications:
curl --socks5 localhost:1080 https://api.example.com
git clone --config http.proxy=socks5://localhost:1080 https://github.com/user/repo

# Edit /etc/proxychains.conf or ~/.proxychains/proxychains.conf
sudo nano /etc/proxychains.conf

# Add at end:
[ProxyList]
socks5 127.0.0.1 1080

# Use with any application:
proxychains firefox
proxychains nmap -sT target-network
proxychains ssh user@internal-server

# Old way (ProxyCommand):
ssh -o ProxyCommand="ssh -W %h:%p user@bastion" user@internal-server

# New way (ProxyJump):
ssh -J user@bastion user@internal-server

# Multiple jumps:
ssh -J user@bastion1,user@bastion2 user@final-destination

# In ~/.ssh/config:
Host internal
    HostName 10.0.1.100
    User admin
    ProxyJump bastion

Host bastion
    HostName bastion.company.com
    User admin

# Usage:
ssh internal  # Automatically jumps through bastion

# Install autossh
sudo apt install autossh

# Create persistent reverse tunnel
autossh -M 0 -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" \
    -R 2222:localhost:22 user@public-server

# -M 0: Disable monitoring port (rely on ServerAlive)
# Tunnel reconnects automatically if connection drops

# Run as systemd service:
sudo nano /etc/systemd/system/reverse-tunnel.service

[Unit]
Description=Reverse SSH Tunnel
After=network.target

[Service]
Type=simple
User=tunneluser
ExecStart=/usr/bin/autossh -M 0 -N -o "ServerAliveInterval 30" \
    -o "ServerAliveCountMax 3" -R 2222:localhost:22 user@public-server
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target

# Enable and start
sudo systemctl enable reverse-tunnel
sudo systemctl start reverse-tunnel
sudo systemctl status reverse-tunnel

# Requires root on both sides and PermitTunnel yes in sshd_config

# Server configuration (/etc/ssh/sshd_config):
PermitTunnel yes

# Create TUN devices:
# Server:
sudo ssh -w 0:0 root@remote-server

# Assign IP addresses:
# On client:
sudo ip addr add 10.0.0.1/24 dev tun0
sudo ip link set tun0 up

# On server:
sudo ip addr add 10.0.0.2/24 dev tun0
sudo ip link set tun0 up

# Now you have a point-to-point VPN!
# Route traffic through tunnel:
sudo ip route add 10.0.1.0/24 via 10.0.0.2

[Laptop] → [Jump1] → [Jump2] → [Jump3] → [Target]

# Establish tunnel through Jump1
ssh -L 2222:jump2:22 user@jump1

# In new terminal, tunnel through Jump2 (via local port 2222)
ssh -p 2222 -L 3333:jump3:22 user@localhost

# In third terminal, tunnel through Jump3 (via local port 3333)
ssh -p 3333 -L 4444:target:22 user@localhost

# Finally, access target (via local port 4444)
ssh -p 4444 user@localhost

# Or use ProxyJump (much easier!):
ssh -J user@jump1,user@jump2,user@jump3 user@target

# In ~/.ssh/config:
Host devserver
    HostName dev.example.com
    User developer
    LocalForward 5432 db.internal:5432
    LocalForward 6379 redis.internal:6379
    LocalForward 9200 es.internal:9200
    ControlMaster auto
    ControlPath ~/.ssh/control-%r@%h:%p
    ControlPersist 10m

# First connection establishes tunnels:
ssh devserver

# All subsequent connections reuse the same tunnel instantly!

# /etc/ssh/sshd_config
AllowTcpForwarding no        # Disable all port forwarding
PermitTunnel no              # Disable TUN/TAP tunneling
GatewayPorts no              # Prevent remote hosts from connecting

# /etc/ssh/sshd_config
Match User developer
    AllowTcpForwarding yes

Match User contractor
    AllowTcpForwarding no

# List active SSH connections and tunnels
sudo ss -tnp | grep sshd

# Check for suspicious port forwards
sudo netstat -tulpn | grep sshd

# Generate tunnel-specific key
ssh-keygen -t ed25519 -C "tunnel-only-key" -f ~/.ssh/id_tunnel

# Restrict key usage in authorized_keys:
# On server:
nano ~/.ssh/authorized_keys

# Add restrictions before key:
no-pty,no-X11-forwarding,permitopen="localhost:5432",permitopen="localhost:6379" ssh-ed25519 AAAAC3...

# Check remote URL
git remote -v

# Change from HTTPS to SSH
git remote set-url origin [email protected]:user/repo.git

# Or when cloning:
git clone [email protected]:user/repo.git

# ~/.ssh/config
Host github-personal
    HostName github.com
    User git
    IdentityFile ~/.ssh/id_ed25519_personal

Host github-work
    HostName github.com
    User git
    IdentityFile ~/.ssh/id_ed25519_work

# Clone work repo:
git clone [email protected]:company/project.git

# Clone personal repo:
git clone github-personal:username/personal-project.git

Tools → Deployment → Configuration
→ Add SFTP connection using SSH credentials

# Connect to remote Docker daemon
export DOCKER_HOST=ssh://user@remote-docker-host

# Or specify in command:
docker -H ssh://user@remote-docker-host ps

# In ~/.ssh/config for convenience:
Host docker-remote
    HostName docker.example.com
    User docker

# Then:
export DOCKER_HOST=ssh://docker-remote
docker ps

name: Deploy to Production

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Setup SSH
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan -H ${{ secrets.SERVER_IP }} >> ~/.ssh/known_hosts

      - name: Deploy
        run: |
          ssh -i ~/.ssh/deploy_key user@${{ secrets.SERVER_IP }} '
            cd /var/www/app &&
            git pull origin main &&
            npm install &&
            pm2 restart app
          '

# Copy file to remote
scp file.txt user@remote:/path/

# Copy directory recursively
scp -r directory/ user@remote:/path/

# Copy from remote to local
scp user@remote:/path/file.txt ./

# Copy between two remote hosts (via your machine)
scp user1@host1:/path/file.txt user2@host2:/path/

# Interactive SFTP session
sftp user@remote

# SFTP commands:
sftp> ls                    # List remote directory
sftp> lls                   # List local directory
sftp> cd /path              # Change remote directory
sftp> lcd /local/path       # Change local directory
sftp> put local.txt         # Upload file
sftp> get remote.txt        # Download file
sftp> put -r directory/     # Upload directory
sftp> get -r directory/     # Download directory
sftp> exit                  # Exit SFTP

# Sync directory to remote (with progress)
rsync -avz --progress /local/dir/ user@remote:/remote/dir/

# Flags:
# -a: Archive mode (recursive, preserve permissions/timestamps)
# -v: Verbose
# -z: Compression
# --progress: Show transfer progress

# Sync from remote to local
rsync -avz user@remote:/remote/dir/ /local/dir/

# Exclude files
rsync -avz --exclude='*.log' --exclude='node_modules/' \
    /local/dir/ user@remote:/remote/dir/

# Dry run (see what would be transferred)
rsync -avzn /local/dir/ user@remote:/remote/dir/

# Delete files on destination not in source
rsync -avz --delete /local/dir/ user@remote:/remote/dir/

# Bandwidth limit (KB/s)
rsync -avz --bwlimit=1000 /local/dir/ user@remote:/remote/dir/

# Generate CA key (store securely!)
ssh-keygen -t ed25519 -f ~/.ssh/ssh_ca -C "SSH Certificate Authority"

# This creates:
# ~/.ssh/ssh_ca       (CA private key - EXTREMELY SENSITIVE!)
# ~/.ssh/ssh_ca.pub   (CA public key)

# /etc/ssh/sshd_config on all servers:
TrustedUserCAKeys /etc/ssh/ssh_ca.pub

# Copy CA public key to servers:
sudo scp ~/.ssh/ssh_ca.pub root@server:/etc/ssh/ssh_ca.pub

# Restart SSH:
sudo systemctl restart sshd

# User generates their key pair
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 -C "rafi@company"

# Send public key to CA admin
scp ~/.ssh/id_ed25519.pub ca-admin@ca-server:~/keys/rafi.pub

# CA admin signs the key (creates certificate)
ssh-keygen -s ~/.ssh/ssh_ca \
    -I rafi@company \
    -n rafi,admin \
    -V +52w \
    ~/keys/rafi.pub

# Explanation:
# -s: CA private key
# -I: Certificate identity (for logging/auditing)
# -n: Principals (usernames user can log in as)
# -V: Validity period (+52w = 52 weeks)

# This creates: rafi-cert.pub (SSH certificate)

# Send certificate back to user
scp ~/keys/rafi-cert.pub rafi@workstation:~/.ssh/id_ed25519-cert.pub

# Certificate must be named: <private_key_name>-cert.pub
# Example: id_ed25519 → id_ed25519-cert.pub

# Connect normally (SSH automatically uses certificate)
ssh rafi@server

# Verify certificate is being used:
ssh -v rafi@server 2>&1 | grep certificate
# Output: debug1: Server accepts key: user-cert-v01@openssh.com

# Server generates host key
sudo ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ""

# CA signs host key
ssh-keygen -s ~/.ssh/ssh_ca \
    -I server.company.com \
    -h \
    -n server.company.com,10.0.1.100 \
    -V +520w \
    /etc/ssh/ssh_host_ed25519_key.pub

# -h: Host certificate (not user certificate)
# -n: Valid hostnames/IPs for this certificate

# Install certificate on server
sudo scp ssh_host_ed25519_key-cert.pub root@server:/etc/ssh/

# Configure server to use certificate
# /etc/ssh/sshd_config:
HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub

sudo systemctl restart sshd

# Clients add CA public key:
# ~/.ssh/known_hosts:
@cert-authority *.company.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... SSH-CA

# Now connections are trusted immediately (no TOFU prompt!)

# Revoke certificate by serial number
ssh-keygen -k -f revoked_keys -s ~/.ssh/ssh_ca \
    -z <serial_number>

# Or by key ID:
ssh-keygen -k -f revoked_keys -I rafi@company

# Deploy CRL to servers:
sudo scp revoked_keys root@server:/etc/ssh/revoked_keys

# Configure servers to check CRL:
# /etc/ssh/sshd_config:
RevokedKeys /etc/ssh/revoked_keys

sudo systemctl restart sshd

# Revoked certificates are immediately denied access!

# Verbose output (single -v)
ssh -v user@server

# Very verbose (double -v)
ssh -vv user@server

# Extremely verbose (triple -v)
ssh -vvv user@server

# What to look for:
# - Which key files are being tried
# - Authentication method used
# - Connection failures and why
# - Key exchange algorithms
# - Host key verification

# Check verbose output
ssh -v user@server

# Common causes:
# - Wrong key being used
# - Key not in authorized_keys
# - Incorrect permissions

# Fix permissions on client:
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub

# Fix permissions on server:
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

# Verify key is in authorized_keys:
ssh user@server "cat ~/.ssh/authorized_keys | grep '$(cat ~/.ssh/id_ed25519.pub)'"

# Error message:
# WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!
# IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!

# Causes:
# - Server reinstalled (new host key)
# - Man-in-the-middle attack (VERIFY!)
# - Server IP reassigned

# Remove old host key:
ssh-keygen -R hostname_or_ip

# Verify new key with server admin before connecting!

# Test connectivity:
ping server-hostname

# Test SSH port:
telnet server-hostname 22
# Or:
nc -zv server-hostname 22

# Common causes:
# - Firewall blocking port
# - SSH service not running
# - Wrong port number

# Check SSH service on server:
sudo systemctl status sshd

# Check firewall:
sudo ufw status
sudo iptables -L -n

# Error: Received disconnect from host: 2: Too many authentication failures

# Cause: SSH client trying too many keys

# Solution: Specify exact key:
ssh -i ~/.ssh/specific_key user@server

# Or in ~/.ssh/config:
Host problematic-server
    HostName server.com
    User admin
    IdentityFile ~/.ssh/specific_key
    IdentitiesOnly yes  # Don't try other keys

# Causes:
# - DNS lookup slow/failing
# - GSSAPI authentication timeout

# Disable DNS lookup (server-side):
# /etc/ssh/sshd_config:
UseDNS no

# Disable GSSAPI (client-side):
ssh -o GSSAPIAuthentication=no user@server

# Or permanently in ~/.ssh/config:
Host *
    GSSAPIAuthentication no

# Press ~? to see help (on new line after Enter)

~.  - Terminate connection
~^Z - Suspend SSH session (bring back with 'fg')
~#  - List forwarded connections
~&  - Background SSH at logout when waiting for connections to terminate
~?  - Display escape sequence help
~C  - Open command line (for adding port forwards mid-session)
~R  - Request connection rekeying

# During active SSH session, press Enter then ~C
ssh> -L 5432:db.internal:5432
Forwarding port.

# Port forward now active without disconnecting!

┌────────────────────────────────────────────────────┐
│         Zero Trust SSH Access Model                │
├────────────────────────────────────────────────────┤
│                                                    │
│  1. Identity Verification (MFA)                    │
│     └─► Certificate-based authentication           │
│                                                    │
│  2. Device Trust                                   │
│     └─► Verify client device security posture      │
│                                                    │
│  3. Least Privilege Access                         │
│     └─► Grant minimum required permissions         │
│                                                    │
│  4. Session Recording                              │
│     └─► Audit all SSH sessions                     │
│                                                    │
│  5. Just-In-Time Access                            │
│     └─► Short-lived certificates (1-8 hours)       │
│                                                    │
│  6. Continuous Monitoring                          │
│     └─► Real-time anomaly detection                │
│                                                    │
└────────────────────────────────────────────────────┘

# === Basic Commands ===
ssh user@host                          # Connect to remote host
ssh -p 2222 user@host                  # Connect on custom port
ssh user@host 'command'                # Execute remote command
scp file user@host:/path               # Copy file to remote
sftp user@host                         # Interactive file transfer

# === Key Generation ===
ssh-keygen -t ed25519 -C "comment"     # Generate Ed25519 key
ssh-keygen -t rsa -b 4096              # Generate RSA 4096-bit key
ssh-copy-id user@host                  # Copy public key to server

# === Port Forwarding ===
ssh -L 8080:localhost:80 user@host     # Local port forward
ssh -R 8080:localhost:80 user@host     # Remote port forward
ssh -D 1080 user@host                  # Dynamic SOCKS proxy

# === Advanced Options ===
ssh -J jump1,jump2 user@final          # ProxyJump through hosts
ssh -N -f user@host                    # Background tunnel (no shell)
ssh -C user@host                       # Enable compression
ssh -v user@host                       # Verbose output (debug)

# === Config File Example ===
# ~/.ssh/config
Host shortname
    HostName full.hostname.com
    User username
    Port 2222
    IdentityFile ~/.ssh/specific_key
    LocalForward 5432 db:5432
    ProxyJump bastion

# === Security Hardening ===
# /etc/ssh/sshd_config
Port 2222
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AllowUsers user1 user2