SSH (Secure Shell)
A cryptographic network protocol for operating network services securely over an unsecured network.
Detailed Explanation
SSH is the standard way for developers and sysadmins to remotely log into servers and execute commands. it uses public-key cryptography for authentication and encrypts all communication. Beyond simple shell access, SSH is used for secure file transfers (SFTP) and creating encrypted tunnels (port forwarding).
Quick Summary
SSH is the encrypted protocol that lets you log into remote machines, transfer files, and tunnel traffic over an untrusted network. It is the universal remote-access tool for Linux and Unix servers.
Key Takeaways
- Public-key authentication is the standard: keep your private key local, place the public key in ~/.ssh/authorized_keys on the server.
- Always prefer keys over passwords, passwords are brute-forceable, keys (with a passphrase) are not.
- Modern key types: ed25519 is the current best choice; RSA ≥3072 bits is acceptable; ECDSA is fine but ed25519 is faster and simpler.
- SSH agent (ssh-agent, 1Password, ssh-agent forwarding) keeps decrypted keys in memory so you don't retype passphrases.
- Beyond shells: SFTP/SCP move files; `ssh -L`/`-R`/`-D` set up local, remote, and SOCKS tunnels.
When to use it
- Logging into VMs and bare-metal servers for administration.
- Pushing/pulling git over SSH (git@github.com:user/repo.git).
- Forwarding a remote port to localhost for debugging without exposing services publicly.
- Running rsync, scp, or sftp for encrypted, resumable file transfers.
Common Mistakes
- Allowing password authentication and root login on internet-facing SSH, invites brute-force attacks.
- Sharing private keys across machines or pasting them into chat, keys should be per-device and never leave.
- Forgetting agent forwarding's security implications; the remote host can use your local key while you're connected.
- Skipping `known_hosts` warnings and accepting fingerprints blindly, that's how MITM attacks succeed.
SSH (Secure Shell), Frequently Asked
How do I generate an SSH key?
`ssh-keygen -t ed25519 -C "your@email"` creates a modern key pair in ~/.ssh/. Copy the public half (.pub file) to the server's ~/.ssh/authorized_keys or paste it into GitHub/GitLab settings.
What's the difference between SSH and TLS?
Both encrypt traffic and authenticate peers, but SSH is designed for interactive sessions and command execution with user accounts; TLS is designed for client-server applications (mostly HTTPS) authenticated by certificates from a CA.
Is SSH obsolete for cloud servers?
Increasingly so for fleets, tools like AWS SSM Session Manager, GCP IAP, and Tailscale SSH provide audited, identity-based access without exposing port 22. For individual servers and homelabs, SSH remains the default.