Documentation/Doc/Network/SSH.md

SSH – Basics

How SSH works, key-based authentication, the config file, and port forwarding.

For generic networking concepts, see:

• Network / Basics

---

1. What Is SSH?

SSH (Secure Shell) is a protocol for opening an encrypted remote session on another machine. It is used primarily to:

• Open an interactive shell on a remote server.
• Transfer files securely (scp, rsync over SSH, sftp).
• Create encrypted tunnels for forwarding traffic.

SSH runs on port 22 by default (TCP). All communication is encrypted end to end.

---

2. Password vs Key-Based Authentication

2.1 Password Authentication

The simplest method: the client sends a username and password. The server verifies against its user database.

Drawbacks:

• Vulnerable to brute-force attacks.
• Must type a password every time.
• Commonly disabled on hardened servers.

2.2 Key-Based Authentication

The client holds a private key (kept secret). The server holds the corresponding public key in ~/.ssh/authorized_keys.

Authentication process:

1. The server sends a challenge that can only be answered by the holder of the private key.
2. The client responds without ever transmitting the private key itself.
3. The server grants access.

This is the recommended method:

• No credential is transmitted over the network.
• Easy to revoke: just remove the public key from the server.
• The private key can be further protected by a local passphrase.

# Generate a key pair (ed25519 is the modern recommended algorithm)
ssh-keygen -t ed25519 -C "my-laptop"
# → creates ~/.ssh/id_ed25519 (private) and ~/.ssh/id_ed25519.pub (public)

# Copy the public key to a remote server
ssh-copy-id user@192.168.1.18

---

3. SSH Config File

The file ~/.ssh/config lets you define shortcuts and options per host, so you don't have to type them every time.

Host homeserver
    HostName 192.168.1.18
    User myuser
    IdentityFile ~/.ssh/id_ed25519
    Port 22

With this, ssh homeserver expands to the full connection automatically.

Option	Purpose
HostName	Real hostname or IP
User	Login username
IdentityFile	Path to the private key to use
Port	SSH port if non-standard
ServerAliveInterval	Send keepalive packets to avoid dropped idle connections

---

4. Port Forwarding and Tunnels

SSH can forward network traffic through the encrypted connection, acting as a lightweight alternative to a VPN.

4.1 Local Forwarding

Makes a port on the remote machine accessible locally:

ssh -L 8080:localhost:8096 homeserver
# localhost:8080 on your machine now reaches the server's port 8096

Useful for accessing a service on a remote machine without exposing it publicly.

4.2 Reverse Forwarding

Makes a local port accessible on the remote machine. Useful for reaching a machine that is behind NAT and cannot accept inbound connections directly.

4.3 Dynamic / SOCKS Proxy

ssh -D 1080 homeserver
# Creates a local SOCKS5 proxy — configure your browser to route traffic through localhost:1080

All proxied traffic goes via the server. A basic VPN alternative for browser traffic.

---

5. Hardening Notes

Common practices for securing an SSH server:

• Disable password authentication (PasswordAuthentication no in /etc/ssh/sshd_config).
• Disable root login (PermitRootLogin no).
• Restrict to specific users with AllowUsers myuser.
• Use a firewall to limit which source IPs can reach port 22.
• Optionally move SSH to a non-standard port to reduce automated scanning noise (not a real security fix, but reduces log clutter).