Knowledge, Server

What is SSH (Secure Shell)?

15
Dec

In the current field of IT, we sometimes need to access systems remotely for tasks such as managing servers, maintaining websites, or transferring files. Therefore, secure and reliable connections are crucial. One widely used tool for this purpose is SSH, or Secure Shell. This article will introduce you to SSH in detail.

What is SSH?

SSH (Secure Shell) is a network protocol that allows users to connect to and control remote devices through the encryption of all data, particularly on Unix/Linux operating systems.

Key Features of SSH:

  • Safer than connecting via Telnet or FTP
  • Supports encrypted data transmission
  • You can verify your identity via password or SSH Key.

How SSH Works

SSH operates through public key cryptography, based on the following fundamental principles:

  • Use a pair of keys (Public Key and Private Key) for encrypting and decrypting information.
  • Use the standard port, which is Port 22.
  • User identity verification is required before access.

Benefits of Using SSH

  • High security: All transmitted data is encrypted.
  • Access from anywhere remotely
  • Can transfer files securely via SCP/SFTP
  • Supports the use of Tunnel to prevent eavesdropping.

Installing SSH

On Linux (Debian/Ubuntu)

  1. Install OpenSSH Server:
    • root@vm01:~# sudo apt update
    • root@vm01:~# sudo apt install openssh-server
  2. Check the status of the SSH service:
    • root@vm01:~# sudo systemctl status ssh
  3. Enable SSH to run automatically on startup:
    • root@vm01:~# sudo systemctl enable ssh
  4. Start using SSH immediately:
    • root@vm01:~# sudo systemctl start ssh

Some systems may use the name sshd instead of ssh (especially on CentOS or RHEL).

On Windows 10/11

  1. Go to Settings → Apps → Optional Features → Add the features “OpenSSH Client” and “OpenSSH Server” (if not already present).
  2. Or use PowerShell: Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 Start-Service sshd Set-Service -Name sshd -StartupType 'Automatic'
  3. Connect to the server using PowerShell or Windows Terminal: ssh user@hostname

On macOS

  1. Enable Remote Login:
    • Go to System Preferences → Sharing → Check “Remote Login”
  2. macOS comes with an SSH client pre-installed. You can use the Terminal immediately: ssh user@hostname

Basic SSH Command Usage

SSH is used to log in or issue commands remotely over a network.

Example command:

  • Connect to Server: ssh user@hostname
  • Specify your own port (e.g., Port 2222 instead of 22): ssh -p 2222 user@hostname
  • Use the Private Key (.pem or .rsa) to log in: ssh -i ~/.ssh/mykey.pem user@hostname
  • You can set up a host alias in ~/.ssh/config: Host myserver HostName example.com User myuser Port 2222 IdentityFile ~/.ssh/mykey.pem

Then, simply use the command ssh myserver.

Using SSH Keys

Using an SSH Key instead of a password enhances security.

Create SSH Key:

ssh-keygen -t rsa -b 4096
  • The default values are stored in ~/.ssh/id_rsa (private) and ~/.ssh/id_rsa.pub (public)

Copy the Public Key to the Server:

ssh-copy-id user@hostname

Or do it yourself:

  1. Open the file ~/.ssh/id_rsa.pub
  2. Copy all the content and paste it into the Server at ~/.ssh/authorized_keys

Don’t forget to grant the appropriate permissions to the file.

chmod 600 ~/.ssh/authorized_keys
chmod 700 ~/.ssh

SSH Agent and Agent Forwarding

SSH Agent helps manage Private Keys without requiring you to enter the password every time.

Start SSH Agent:

eval "$(ssh-agent -s)"

Add Key to Agent:

ssh-add ~/.ssh/id_rsa

Forward Agent (use the same key when SSHing to multiple machines consecutively):

Add to ~/.ssh/config:

Host *
  ForwardAgent yes

Suitable for working across multiple servers without needing to re-enter the key.

SCP and SFTP

Use SSH for file transfer

SCP (Secure Copy):

  • Send file from our machine to Server: scp file.txt user@host:/path/
  • Download files from the server: scp user@host:/path/file.txt.
  • Send all folders: scp -r myfolder user@host:/destination/

SFTP (SSH File Transfer Protocol):

  • Start using: sftp user@hostname
  • SFTP Internal Commands:
    • ls displays files
    • get filename Download file
    • put filename Upload file
    • cd: Change directory

SSH Tunnel

SSH Tunnel allows us to securely transmit data over SSH, especially when accessing internal systems.

Local Port Forwarding

For example, to access MySQL on the server via port 3306:

ssh -L 3306:localhost:3306 user@host
  • We can now connect to localhost:3306 on our machine as if we were on the server.

Remote Port Forwarding

If you want to open your machine’s port for access from people on the server:

ssh -R 8080:localhost:80 user@host

Dynamic Port Forwarding (SOCKS Proxy)

Suitable for using web proxy via SSH:

ssh -D 1080 user@host

Then, configure your browser or other programs to use the SOCKS proxy at localhost:1080.

Security Settings

  • Disable root login
  • Disable login with a password.
  • Enable Fail2Ban
  • Use a firewall to restrict IP addresses.

User Management

  • Add New User:
sudo adduser newuser
  • Create a .ssh folder and an authorized_keys file.

Frequently Encountered Issues

  • Connection refused: The SSH server may not be running or a firewall may be blocking.
  • Permission denied: Incorrect key or unauthorized access.
  • Timeout: Connection failed due to latency or firewall.

Summary:

SSH is a fundamental tool essential for remote system management, particularly in the era of Cloud and DevOps. Those who learn and understand SSH will be able to perform system and security tasks more efficiently and securely.