SSH: Getting Started with SSH | Amr Tarek

What is SSH?

SSH (Secure Shell) is the secured replacement for Telnet. While Telnet transmits all data including credentials in plaintext, SSH encrypts the entire session — protecting authentication, commands, and data transfer from interception.

Telnet (Port 23):
Client --> [username: admin] --> Network (PLAINTEXT) --> Server
Client --> [password: secret] --> Network (PLAINTEXT) --> Server

SSH (Port 22):
Client --> [ENCRYPTED SESSION] --> Network --> Server
         (credentials, commands, all data protected)

SSH provides:

Encrypted communication — all data is protected in transit
Server authentication — verifies you're connecting to the right server
Client authentication — via password or cryptographic key pairs
Port forwarding — tunnel other protocols securely through SSH

Installing OpenSSH

OpenSSH is available in the default repositories of all major Linux distributions.

# Debian and Ubuntu
sudo apt install openssh-server

# Fedora and RHEL
sudo dnf install openssh-server

# Arch Linux
sudo pacman -S openssh

Managing the SSH Service

# Start the SSH service
sudo systemctl start ssh

# Enable SSH to start automatically at boot
sudo systemctl enable ssh

# Check current SSH service status
sudo systemctl status ssh

# Restart SSH after configuration changes
sudo systemctl restart ssh

Checking SSH Listening Ports

Verify that SSH is running and listening on the expected port:

netstat -tlnp | grep ssh

This shows the port SSH is bound to (default: 22) and confirms the service is active.

SSH Configuration File

The SSH server configuration is stored at /etc/ssh/sshd_config. Key settings to be aware of:

# Edit the SSH server configuration
sudo nano /etc/ssh/sshd_config

Important sshd_config directives:
Port 22                    # Port SSH listens on
PermitRootLogin no         # Disable direct root login
PasswordAuthentication yes # Allow password auth (disable after key setup)
PubkeyAuthentication yes   # Allow key-based auth
AllowUsers user1 user2     # Restrict which users can SSH in

After any configuration change, restart SSH to apply:

sudo systemctl restart ssh

Connecting to Remote Servers

Basic Connection

# Connect to a remote server as a specific user
ssh user@remote_host

# Examples:
ssh admin@192.168.1.100
ssh deploy@production-server.example.com

Connecting on a Non-Default Port

# Connect when SSH is running on a custom port
ssh -p 2222 user@remote_host

Connecting with a Specific Identity File

# Specify which private key to use for authentication
ssh -i ~/.ssh/id_rsa user@remote_host

# Example with a named key
ssh -i ~/.ssh/company_server_key deploy@server.example.com

Running a Command Remotely Without an Interactive Session

# Execute a single command on the remote host and return
ssh user@remote_host "ls -la"

# Run multiple commands
ssh user@remote_host "uname -a && df -h && uptime"

This is useful for automation scripts that need to execute remote commands without maintaining an interactive session.

Basic Key-Based Authentication Setup

Key-based authentication is more secure than passwords because it requires possession of a private key file rather than knowledge of a password.

Generate an SSH Key Pair

# Generate RSA key pair with 4096-bit key size
ssh-keygen -t rsa -b 4096

# You will be prompted for:
# - File location (default: ~/.ssh/id_rsa)
# - Passphrase (optional but recommended for additional security)

This creates two files:

~/.ssh/id_rsa — your private key (keep this secret, never share it)
~/.ssh/id_rsa.pub — your public key (safe to share, copied to servers)

Copy Public Key to Remote Server

# Automatically append public key to remote authorized_keys
ssh-copy-id user@remote_host

# For a non-default port
ssh-copy-id -p 2222 user@remote_host

Manually Adding Keys

If ssh-copy-id is not available:

# Append public key to the remote authorized_keys file
cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys

# Or copy it manually to the remote server

Using ssh-agent for Key Management

The ssh-agent is a background process that holds your decrypted private keys in memory, so you only need to enter the passphrase once per session.

# Start the SSH agent and configure the current shell to use it
eval "$(ssh-agent -s)"

# Add your private key to the agent
ssh-add ~/.ssh/id_rsa
# Enter passphrase once — agent handles subsequent authentication

With the key loaded in the agent, SSH connections to authorized servers proceed without prompting for a passphrase each time.

SSH Connection Workflow

First Connection to a New Host:
User connects --> Server presents host key fingerprint
User verifies --> "yes" to accept and save fingerprint
Fingerprint saved to ~/.ssh/known_hosts
Future connections verify against saved fingerprint automatically

Authentication:
1. Server sends challenge
2. Client proves identity (key or password)
3. Session established and encrypted
4. Commands execute over encrypted channel

Key Files Reference

File	Location	Purpose
`id_rsa`	`~/.ssh/id_rsa`	Private key — never share
`id_rsa.pub`	`~/.ssh/id_rsa.pub`	Public key — copy to servers
`authorized_keys`	`~/.ssh/authorized_keys`	Public keys allowed to connect
`known_hosts`	`~/.ssh/known_hosts`	Fingerprints of trusted servers
`config`	`~/.ssh/config`	Per-host SSH configuration
`sshd_config`	`/etc/ssh/sshd_config`	Server-side SSH configuration