124 lines
3.9 KiB
Markdown
124 lines
3.9 KiB
Markdown
# SSH – Basics
|
||
|
||
How SSH works, key-based authentication, the config file, and port forwarding.
|
||
|
||
For generic networking concepts, see:
|
||
|
||
- [Network / Basics](./Basics.md)
|
||
|
||
---
|
||
|
||
## 1. What Is SSH?
|
||
|
||
**SSH** (Secure Shell) is a protocol for opening an encrypted remote session on another machine. It is used primarily to:
|
||
|
||
- Open an interactive shell on a remote server.
|
||
- Transfer files securely (`scp`, `rsync over SSH`, `sftp`).
|
||
- Create encrypted tunnels for forwarding traffic.
|
||
|
||
SSH runs on port 22 by default (TCP). All communication is encrypted end to end.
|
||
|
||
---
|
||
|
||
## 2. Password vs Key-Based Authentication
|
||
|
||
### 2.1 Password Authentication
|
||
|
||
The simplest method: the client sends a username and password. The server verifies against its user database.
|
||
|
||
Drawbacks:
|
||
|
||
- Vulnerable to brute-force attacks.
|
||
- Must type a password every time.
|
||
- Commonly disabled on hardened servers.
|
||
|
||
### 2.2 Key-Based Authentication
|
||
|
||
The client holds a **private key** (kept secret). The server holds the corresponding **public key** in `~/.ssh/authorized_keys`.
|
||
|
||
Authentication process:
|
||
|
||
1. The server sends a challenge that can only be answered by the holder of the private key.
|
||
2. The client responds without ever transmitting the private key itself.
|
||
3. The server grants access.
|
||
|
||
This is the recommended method:
|
||
|
||
- No credential is transmitted over the network.
|
||
- Easy to revoke: just remove the public key from the server.
|
||
- The private key can be further protected by a local passphrase.
|
||
|
||
```bash
|
||
# Generate a key pair (ed25519 is the modern recommended algorithm)
|
||
ssh-keygen -t ed25519 -C "my-laptop"
|
||
# → creates ~/.ssh/id_ed25519 (private) and ~/.ssh/id_ed25519.pub (public)
|
||
|
||
# Copy the public key to a remote server
|
||
ssh-copy-id user@192.168.1.18
|
||
```
|
||
|
||
---
|
||
|
||
## 3. SSH Config File
|
||
|
||
The file `~/.ssh/config` lets you define shortcuts and options per host, so you don't have to type them every time.
|
||
|
||
```
|
||
Host homeserver
|
||
HostName 192.168.1.18
|
||
User myuser
|
||
IdentityFile ~/.ssh/id_ed25519
|
||
Port 22
|
||
```
|
||
|
||
With this, `ssh homeserver` expands to the full connection automatically.
|
||
|
||
| Option | Purpose |
|
||
|--------------------------|-------------------------------------------------------------|
|
||
| `HostName` | Real hostname or IP |
|
||
| `User` | Login username |
|
||
| `IdentityFile` | Path to the private key to use |
|
||
| `Port` | SSH port if non-standard |
|
||
| `ServerAliveInterval` | Send keepalive packets to avoid dropped idle connections |
|
||
|
||
---
|
||
|
||
## 4. Port Forwarding and Tunnels
|
||
|
||
SSH can forward network traffic through the encrypted connection, acting as a lightweight alternative to a VPN.
|
||
|
||
### 4.1 Local Forwarding
|
||
|
||
Makes a port on the remote machine accessible locally:
|
||
|
||
```bash
|
||
ssh -L 8080:localhost:8096 homeserver
|
||
# localhost:8080 on your machine now reaches the server's port 8096
|
||
```
|
||
|
||
Useful for accessing a service on a remote machine without exposing it publicly.
|
||
|
||
### 4.2 Reverse Forwarding
|
||
|
||
Makes a local port accessible on the remote machine. Useful for reaching a machine that is behind NAT and cannot accept inbound connections directly.
|
||
|
||
### 4.3 Dynamic / SOCKS Proxy
|
||
|
||
```bash
|
||
ssh -D 1080 homeserver
|
||
# Creates a local SOCKS5 proxy — configure your browser to route traffic through localhost:1080
|
||
```
|
||
|
||
All proxied traffic goes via the server. A basic VPN alternative for browser traffic.
|
||
|
||
---
|
||
|
||
## 5. Hardening Notes
|
||
|
||
Common practices for securing an SSH server:
|
||
|
||
- Disable password authentication (`PasswordAuthentication no` in `/etc/ssh/sshd_config`).
|
||
- Disable root login (`PermitRootLogin no`).
|
||
- Restrict to specific users with `AllowUsers myuser`.
|
||
- Use a firewall to limit which source IPs can reach port 22.
|
||
- Optionally move SSH to a non-standard port to reduce automated scanning noise (not a real security fix, but reduces log clutter). |