Skip to content

SSH config

SSH Key Generation

# Generate an Ed25519 key (recommended for modern systems)
ssh-keygen -t ed25519 -C "your_email@example.com"

# For systems that don't support Ed25519, use RSA with 4096 bits
ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

To enable key-based login on a server, add the public key to the ~/.ssh/authorized_keys file on the remote system:

ssh-copy-id mark@ip_server

Useful SSH Options

# Connect on a non-standard port
ssh -p 2222 marijk@ip_target

# Use a specific private key
ssh -i ~/.ssh/custom_key marijk@ip_target

# Jump through a bastion/jump host to reach an internal server
ssh -J bastion.example.com marijk@ip_target

# Local port forwarding (access remote service through local port)
ssh -L 8080:localhost:80 marijk@ip_target

# Dynamic port forwarding (SOCKS proxy)
ssh -D 9050 marijk@ip_target

# Run a single command without interactive shell
ssh marijk@ip_target "cat /etc/passwd"

SSH Config File

For frequent connections, you can create shortcuts in ~/.ssh/config:

Host webserver
    HostName ip_target
    User mark
    Port 22
    IdentityFile ~/.ssh/id_ed25519

Host internal
    HostName ip_target
    User admin
    ProxyJump bastion.example.com
usage: ssh webserver

Secure File Transfer

SFTP (SSH File Transfer Protocol) is the recommended method for interactive file transfers.

sftp marijk@ip_target

rsync over SSH

Is preferred for transferring large amounts of data or synchronising directories, as it only transfers changed portions of files

rsync -avz -e ssh /local/directory/ marijk@ip_target:/remote/directory/

SSH Hardening Considerations

When assessing or configuring SSH servers, consider these security settings in /etc/ssh/sshd_config

  • Disable password authentication (PasswordAuthentication no) after setting up key-based auth.
  • Disable root login (PermitRootLogin no) to force users to authenticate as regular users first.
  • Use AllowUsers or AllowGroups to restrict which accounts can log in via SSH.
  • Change the default port to reduce automated scanning noise (security through obscurity, not a strong control).
  • Enable fail2ban or similar to block repeated failed authentication attempts.
  • Use modern key exchange and cipher algorithms by configuring KexAlgorithms, Ciphers, and MACs.