Stop 02 · Linux & Command LineTopics · 10/11

SSH & Remote Access

In short

Your servers live in a data centre you'll never visit. SSH is the secure door you use to log in, run commands and copy files, many times a day.

The standard secure protocol for connecting to and managing remote servers — key-based authentication, port forwarding, and basic SSH config are daily-use DevOps skills.

The mascot walks up to an office gate where a guard compares a photo card with the mascot's face.

Think of it like this

The guard who knows your face

The office guard keeps your photo in his register. When you arrive, he checks your face against it and lets you in, no password shouted across the gate. Your face never leaves you. SSH keys work like this: the server keeps your public key, you keep the private one.

Watch it happen

Logging in with an SSH key

Your laptop

Server sshd

ssh riya@10.0.1.5

1/6You connect. Both sides set up an encrypted channel first, so nobody can read the rest.

The big ideas

What you need to know

Keys beat passwords

Keys can't be guessed by bots trying passwords. Many teams turn off password login completely.

Guard the private key

~/.ssh/id_ed25519 must stay on your laptop with chmod 600. Add a passphrase so a stolen laptop isn't enough.

~/.ssh/config saves typing

Give servers short names with their user, IP and key, then just type ssh web1.

scp and port forwarding

scp copies files over SSH. ssh -L lets you reach a private database through the server safely.

See it in code

Walk through the code

bash

1ssh-keygen -t ed25519 -C "riya@laptop"2ssh-copy-id riya@203.0.113.103ssh riya@203.0.113.104 5# ~/.ssh/config6Host web17  HostName 203.0.113.108  User riya9  IdentityFile ~/.ssh/id_ed2551910 11scp ./app.tar.gz web1:/tmp/12ssh -L 5432:localhost:5432 web1   # reach the server's Postgres locally

1/3Make a key pair, copy the public half to the server, then log in without a password.

On cloud servers like EC2, you usually download or upload a key when creating the machine instead of using ssh-copy-id.

Save yourself the pain

Common mistakes

Oops

Emailing your private key to a teammate so they can access the server.

Do this instead

Each person makes their own key pair. Add their public key to authorized_keys instead.

Oops

Leaving password login and root login open on an internet-facing server.

Do this instead

Set PasswordAuthentication no and PermitRootLogin no in sshd_config, after confirming your key works.

Your mission

Password-free login

~25 min

Quick check

During SSH key login, what does your laptop send to the server?

Go deeper

1Set up SSH key-based authentication to a remote server instead of using a password.
2Learn to use an SSH config file to simplify connecting to frequently used servers.
3Understand basic SSH security practices: disabling password auth, restricting root login.