Add network & containerisation

Doc/Network/SSH.md

@@ -1 +1,124 @@
-## TODO
+# SSH – Basics
+
+How SSH works, key-based authentication, the config file, and port forwarding.
+
+For generic networking concepts, see:
+
+- [Network / Basics](./Basics.md)
+
+---
+
+## 1. What Is SSH?
+
+**SSH** (Secure Shell) is a protocol for opening an encrypted remote session on another machine. It is used primarily to:
+
+- Open an interactive shell on a remote server.
+- Transfer files securely (`scp`, `rsync over SSH`, `sftp`).
+- Create encrypted tunnels for forwarding traffic.
+
+SSH runs on port 22 by default (TCP). All communication is encrypted end to end.
+
+---
+
+## 2. Password vs Key-Based Authentication
+
+### 2.1 Password Authentication
+
+The simplest method: the client sends a username and password. The server verifies against its user database.
+
+Drawbacks:
+
+- Vulnerable to brute-force attacks.
+- Must type a password every time.
+- Commonly disabled on hardened servers.
+
+### 2.2 Key-Based Authentication
+
+The client holds a **private key** (kept secret). The server holds the corresponding **public key** in `~/.ssh/authorized_keys`.
+
+Authentication process:
+
+1. The server sends a challenge that can only be answered by the holder of the private key.
+2. The client responds without ever transmitting the private key itself.
+3. The server grants access.
+
+This is the recommended method:
+
+- No credential is transmitted over the network.
+- Easy to revoke: just remove the public key from the server.
+- The private key can be further protected by a local passphrase.
+
+```bash
+# Generate a key pair (ed25519 is the modern recommended algorithm)
+ssh-keygen -t ed25519 -C "my-laptop"
+# → creates ~/.ssh/id_ed25519 (private) and ~/.ssh/id_ed25519.pub (public)
+
+# Copy the public key to a remote server
+ssh-copy-id user@192.168.1.18
+```
+
+---
+
+## 3. SSH Config File
+
+The file `~/.ssh/config` lets you define shortcuts and options per host, so you don't have to type them every time.
+
+```
+Host homeserver
+    HostName 192.168.1.18
+    User myuser
+    IdentityFile ~/.ssh/id_ed25519
+    Port 22
+```
+
+With this, `ssh homeserver` expands to the full connection automatically.
+
+| Option                   | Purpose                                                     |
+|--------------------------|-------------------------------------------------------------|
+| `HostName`               | Real hostname or IP                                         |
+| `User`                   | Login username                                              |
+| `IdentityFile`           | Path to the private key to use                              |
+| `Port`                   | SSH port if non-standard                                    |
+| `ServerAliveInterval`    | Send keepalive packets to avoid dropped idle connections    |
+
+---
+
+## 4. Port Forwarding and Tunnels
+
+SSH can forward network traffic through the encrypted connection, acting as a lightweight alternative to a VPN.
+
+### 4.1 Local Forwarding
+
+Makes a port on the remote machine accessible locally:
+
+```bash
+ssh -L 8080:localhost:8096 homeserver
+# localhost:8080 on your machine now reaches the server's port 8096
+```
+
+Useful for accessing a service on a remote machine without exposing it publicly.
+
+### 4.2 Reverse Forwarding
+
+Makes a local port accessible on the remote machine. Useful for reaching a machine that is behind NAT and cannot accept inbound connections directly.
+
+### 4.3 Dynamic / SOCKS Proxy
+
+```bash
+ssh -D 1080 homeserver
+# Creates a local SOCKS5 proxy — configure your browser to route traffic through localhost:1080
+```
+
+All proxied traffic goes via the server. A basic VPN alternative for browser traffic.
+
+---
+
+## 5. Hardening Notes
+
+Common practices for securing an SSH server:
+
+- Disable password authentication (`PasswordAuthentication no` in `/etc/ssh/sshd_config`).
+- Disable root login (`PermitRootLogin no`).
+- Restrict to specific users with `AllowUsers myuser`.
+- Use a firewall to limit which source IPs can reach port 22.
+- Optionally move SSH to a non-standard port to reduce automated scanning noise (not a real security fix, but reduces log clutter).