Keys#
ssh-keygen -t ed25519 -C "you@laptop" # create a key pair
ssh-copy-id user@server # install your public key
eval "$(ssh-agent -s)" && ssh-add ~/.ssh/id_ed25519
ssh-keygen -lf ~/.ssh/id_ed25519.pub # show a key fingerprint
Connect#
ssh user@server
ssh -p 2222 user@server # non-default port
ssh -i ~/.ssh/work_key user@server # specific key
ssh user@server 'uptime && df -h' # run a remote command
~/.ssh/config#
Host web
HostName 203.0.113.10
User deploy
Port 2222
IdentityFile ~/.ssh/work_key
Host *.internal
ProxyJump bastion
Then simply run ssh web.
Tunnels#
| Goal | Command |
|---|---|
| Reach remote port 5432 on localhost:5432 | ssh -L 5432:localhost:5432 web |
| Expose local port 3000 on the server | ssh -R 8080:localhost:3000 web |
| SOCKS proxy on localhost:1080 | ssh -D 1080 web |
| Jump through a bastion host | ssh -J bastion user@private-host |
Copy files#
scp file.txt web:/tmp/
scp -r web:/var/log/app ./logs
rsync -avz --progress ./site/ web:/srv/site/
Server hardening (/etc/ssh/sshd_config)#
PasswordAuthentication no
PermitRootLogin no
PubkeyAuthentication yes
Validate with sudo sshd -t, then reload with sudo systemctl reload sshd.