SSH and Remote Administration

SSH (Secure Shell) is the standard tool for secure remote login and command execution on Unix-like systems. This handbook covers the everyday toolkit: connections, keys, client configuration, file transfer, tunnelling, host keys and troubleshooting.

When this handbook is useful: while administering a VPS or LAN server, automating connections, securely transferring files, reaching services through tunnels, or diagnosing authentication failures.

For system context, see Debian 13 - Desktop + Server Handbook, FreeBSD as a Server, and Linux Permissions and Server Security.

1. SSH

Basic connection:

ssh user@server

Custom port:

ssh -p 2222 user@server

2. Keys

ssh-keygen -t ed25519

Default paths:

~/.ssh/id_ed25519
~/.ssh/id_ed25519.pub

Never share the private key.

3. Copying a key

ssh-copy-id user@server

4. authorized_keys

On the server:

~/.ssh/authorized_keys

Permissions:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

5. SSH config

~/.ssh/config

Example:

Host myvps
    HostName 203.0.113.10
    User user
    IdentityFile ~/.ssh/id_ed25519

Then:

ssh myvps

6. SCP

Upload:

scp file.txt myvps:/tmp/

Download:

scp myvps:/var/log/app.log .

7. rsync

Better for directories and updates:

rsync -avz ./site/ myvps:/var/www/site/

Delete destination files that no longer exist at the source:

rsync -avz --delete ./site/ myvps:/var/www/site/

Use --delete carefully.

8. SFTP

sftp myvps

Useful commands:

ls
cd
lcd
get
put
exit

9. SSH agent

ssh-add ~/.ssh/id_ed25519
ssh-add -l

The agent keeps an unlocked key available during the session.

10. Local forwarding

ssh -L 5433:127.0.0.1:5432 myvps

Local port 5433 now tunnels to PostgreSQL on the server.

11. Remote forwarding

ssh -R 9000:127.0.0.1:3000 myvps

This can expose a local service on the remote side.

12. SOCKS proxy

ssh -D 1080 myvps

Creates a local SOCKS proxy.

13. ProxyJump

Host internal
    HostName 10.0.0.20
    User user
    ProxyJump bastion

14. Remote command

ssh myvps 'systemctl status nginx'

15. SSHFS

If installed:

sshfs myvps:/srv/project ~/mnt/project

16. Troubleshooting

Verbose mode:

ssh -v myvps
ssh -vvv myvps

17. Known hosts

SSH stores host fingerprints in:

~/.ssh/known_hosts

A changed fingerprint may indicate a legitimate reinstall or a MITM attack. Do not ignore the warning without checking.

18. Keepalive

Host *
    ServerAliveInterval 60
    ServerAliveCountMax 3

19. Security

• prefer keys over passwords,
• protect keys with passphrases,
• use limited permissions,
• do not copy private keys unnecessarily,
• do not use root as your everyday account.

20. What you should know

You should be able to connect with a key, configure ~/.ssh/config, use scp/rsync/sftp, create a local tunnel and diagnose a connection with ssh -v.

21. Documentation and sources

OpenSSH's own manual pages are the primary reference:

• ssh(1)
  https://man.openbsd.org/ssh
• ssh_config(5)
  https://man.openbsd.org/ssh_config
• sshd_config(5)
  https://man.openbsd.org/sshd_config
• ssh-keygen(1)
  https://man.openbsd.org/ssh-keygen
• ssh-agent(1)
  https://man.openbsd.org/ssh-agent

Treat the private key as a secret. The public key is intended to be installed in ~/.ssh/authorized_keys on the destination host.