Linux CLI 33 🐧 ssh command - KandZ

ssh kronos@192.168.1.201

ssh-keygen -t rsa

ssh (Secure Shell) is the standard way to log into a remote Linux/Unix system and run commands on it. Unlike telnet or rlogin, everything sent over an SSH connection is encrypted — including your password. This makes SSH safe to use even over untrusted networks like the internet.

Key point: SSH uses public-key cryptography for both encryption and authentication. You can log in with a password, or — more securely and conveniently — with a key pair.

a – ssh command

ssh connects to a remote server. It is secure and it does not share your password in plain text. You can log into a Linux or Unix system and execute commands on it as if you were sitting in front of it.

Basic syntax:

ssh user@hostname

user is the username on the remote system
Instead of hostname, you can also use an IP address

Examples:

# Connect using a hostname
$ ssh kronos@server.example.com
The authenticity of host 'server.example.com (203.0.113.10)' can't be established.
ED25519 key fingerprint is SHA256:abc123def456...
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'server.example.com' (ED25519) to the list of known hosts.
kronos@server.example.com's password:
Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-91-generic x86_64)
...
kronos@server:~$

# Connect using an IP address
$ ssh kronos@192.168.1.201
kronos@192.168.1.201's password:
...
kronos@server:~$

# Run a single command remotely (no interactive shell)
$ ssh kronos@192.168.1.201 "uname -a"
Linux server 5.15.0-91-generic #101-Ubuntu SMP ... x86_64 GNU/Linux

# Use a different port
$ ssh -p 2222 kronos@192.168.1.201

# Verbose mode (great for debugging)
$ ssh -v kronos@192.168.1.201

The first connection: The first time you connect to a host, SSH asks you to verify its fingerprint. This protects against man-in-the-middle attacks. Type yes to accept and store the host key in ~/.ssh/known_hosts.

Installing SSH:

Distro Family	Command
Red Hat / Fedora	`sudo yum install openssh-clients openssh-server`
Red Hat / Fedora (dnf)	`sudo dnf install openssh-clients openssh-server`
Debian / Ubuntu	`sudo apt install openssh-client openssh-server`

After installing the server, enable and start it:

$ sudo systemctl enable sshd
$ sudo systemctl start sshd
$ sudo systemctl status sshd

Useful ssh options:

Option	Purpose
`-p PORT`	Connect to a non-default port
`-i FILE`	Use a specific private key
`-v`	Verbose output (debug)
`-X`	Enable X11 forwarding (GUI apps)
`-L`	Local port forwarding
`-R`	Remote port forwarding
`-N`	Don’t run a remote command (tunnels)
`-C`	Compress data
`-o OPTION`	Set a config option

Examples:

# Run a command on a remote host and exit
$ ssh kronos@192.168.1.201 "df -h"
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda2       237G   45G  180G  20% /

# Copy SSH keys to a remote host (uses SSH under the hood)
$ ssh-copy-id kronos@192.168.1.201

# X11 forwarding (run GUI apps remotely)
$ ssh -X kronos@192.168.1.201
$ firefox   # opens on your local display

# Persistent connection (reuse for speed)
$ ssh -o ControlMaster=auto -o ControlPath=~/.ssh/cm-%r@%h:%p kronos@host

b – ssh login with SSH Key Pair

You can log in to a remote system without a password by using an SSH key pair. This is both more secure (keys are much harder to brute-force than passwords) and more convenient.

Step 1 — Create an SSH key pair:

ssh-keygen -t rsa

Press Enter when prompted for a file name and location, leaving the defaults as is (just hit Enter).
Enter a passphrase when prompted — this will be used to encrypt your private key.
You will then be prompted to confirm the passphrase — press Enter again to continue.

Example:

$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/kronos/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/kronos/.ssh/id_rsa
Your public key has been saved in /home/kronos/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:abc123def456... kronos@olympos
The key's randomart image is:
+---[RSA 3072]----+
|       .o.        |
|      .  o        |
|     . .  .       |
|      o  . .      |
|     . .S. .      |
|      o +..       |
|     . +o+.       |
|      .o*Eo.      |
|      .++=+o.     |
+----[SHA256]-----+

This creates two files in ~/.ssh/:

File	Purpose	Share?
`id_rsa`	Private key — keep secret!	❌ Never
`id_rsa.pub`	Public key — copy to servers	✅ Yes

Step 2 — Copy the public key to the server:

cat ~/.ssh/id_rsa.pub | ssh user@hostname "mkdir -p .ssh && chmod 700 .ssh && cat >> .ssh/authorized_keys"

Replace user with your user and hostname with the remote system’s hostname or IP address.

Step 3 — Test the login:

$ ssh kronos@192.168.1.201
# No password prompt — you're in!
kronos@server:~$

How it works:

┌──────────────────────────────────────────────┐
│              Your Computer                   │
│                                              │
│  ~/.ssh/id_rsa       ← private key (secret)  │
│  ~/.ssh/id_rsa.pub   ← public key            │
│                                              │
└─────────────────┬────────────────────────────┘
                  │
                  │  ssh user@host
                  ▼
┌──────────────────────────────────────────────┐
│              Remote Server                   │
│                                              │
│  ~/.ssh/authorized_keys  ← contains your     │
│                             public key       │
│                                              │
│  Server sends a challenge encrypted with     │
│  the public key. Only your private key       │
│  can decrypt it → you're authenticated.     │
│                                              │
└──────────────────────────────────────────────┘

Shortcuts:

ssh-copy-id user@host — does the same thing as the cat | ssh pipeline, but simpler.
ssh-add ~/.ssh/id_rsa — add your key to the SSH agent so you only type the passphrase once per session.
ssh-agent — runs in the background and holds decrypted keys in memory.

Examples:

# Simpler way to copy your key
$ ssh-copy-id kronos@192.168.1.201
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
...
Number of key(s) added: 1

# Start the agent and add your key
$ eval $(ssh-agent)
Agent pid 12345
$ ssh-add ~/.ssh/id_rsa
Enter passphrase for /home/kronos/.ssh/id_rsa:
Identity added: /home/kronos/.ssh/id_rsa (kronos@olympos)

# List keys the agent knows
$ ssh-add -l
3072 SHA256:abc123def456... kronos@olympos (RSA)

# Connect without typing the passphrase
$ ssh kronos@192.168.1.201
kronos@server:~$

Complete Example Session

# ============================================
# PART 1: INSTALL SSH
# ============================================

# Debian / Ubuntu
$ sudo apt update
$ sudo apt install openssh-client openssh-server
$ sudo systemctl enable sshd
$ sudo systemctl start sshd

# Red Hat / Fedora
$ sudo dnf install openssh-clients openssh-server
$ sudo systemctl enable sshd
$ sudo systemctl start sshd

# ============================================
# PART 2: FIRST SSH CONNECTION
# ============================================

$ ssh kronos@192.168.1.201
The authenticity of host '192.168.1.201 (192.168.1.201)' can't be established.
ED25519 key fingerprint is SHA256:abc123def456...
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.1.201' (ED25519) to the list of known hosts.
kronos@192.168.1.201's password:
Welcome to Ubuntu 22.04.3 LTS
...
kronos@server:~$ exit
logout
Connection to 192.168.1.201 closed.

# ============================================
# PART 3: RUN A REMOTE COMMAND
# ============================================

$ ssh kronos@192.168.1.201 "uname -a && uptime"
Linux server 5.15.0-91-generic #101-Ubuntu SMP ... x86_64 GNU/Linux
 10:35:01 up 3 days,  4:22,  1 user,  load average: 0.12, 0.08, 0.05

# ============================================
# PART 4: CREATE AN SSH KEY PAIR
# ============================================

$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/kronos/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/kronos/.ssh/id_rsa
Your public key has been saved in /home/kronos/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:abc123def456... kronos@olympos

# ============================================
# PART 5: COPY THE PUBLIC KEY TO THE SERVER
# ============================================

$ cat ~/.ssh/id_rsa.pub | ssh kronos@192.168.1.201 "mkdir -p .ssh && chmod 700 .ssh && cat >> .ssh/authorized_keys"
kronos@192.168.1.201's password:
# (no output — key copied)

# Or use ssh-copy-id
$ ssh-copy-id kronos@192.168.1.201
Number of key(s) added: 1

# ============================================
# PART 6: TEST PASSWORDLESS LOGIN
# ============================================

$ ssh kronos@192.168.1.201
Enter passphrase for key '/home/kronos/.ssh/id_rsa':
kronos@server:~$
# ✅ No password prompt for the server

# ============================================
# PART 7: USE THE SSH AGENT
# ============================================

$ eval $(ssh-agent)
Agent pid 12345
$ ssh-add ~/.ssh/id_rsa
Enter passphrase for /home/kronos/.ssh/id_rsa:
Identity added: /home/kronos/.ssh/id_rsa (kronos@olympos)

$ ssh kronos@192.168.1.201
kronos@server:~$
# ✅ No passphrase prompt either!

# ============================================
# PART 8: VERIFY KEYS
# ============================================

$ ls -la ~/.ssh/
-rw------- 1 kronos kronos 2602 Jan 15 10:00 id_rsa
-rw-r--r-- 1 kronos kronos  567 Jan 15 10:00 id_rsa.pub
-rw-r--r-- 1 kronos kronos  222 Jan 15 10:05 known_hosts

$ ssh-add -l
3072 SHA256:abc123def456... kronos@olympos (RSA)

# ============================================
# PART 9: CLEAN UP (REMOVE KEY FROM SERVER)
# ============================================

$ ssh kronos@192.168.1.201 "sed -i '/kronos@olympos/d' ~/.ssh/authorized_keys"

Quick Reference

ssh Basics

Command	Purpose
`ssh user@host`	Connect to a remote host
`ssh user@IP`	Connect using an IP
`ssh -p PORT user@host`	Connect on a custom port
`ssh -i KEY user@host`	Use a specific private key
`ssh -v user@host`	Verbose debug output
`ssh user@host "CMD"`	Run a single remote command
`ssh -X user@host`	Enable X11 forwarding
`exit`	Close the SSH session

Installing SSH

Distro	Command
Debian/Ubuntu	`sudo apt install openssh-client openssh-server`
Red Hat/Fedora	`sudo dnf install openssh-clients openssh-server`
Enable server	`sudo systemctl enable --now sshd`

SSH Keys

Command	Purpose
`ssh-keygen -t rsa`	Create an RSA key pair
`ssh-keygen -t ed25519`	Create an Ed25519 key pair (modern)
`ssh-copy-id user@host`	Copy public key to server
`ssh-add ~/.ssh/id_rsa`	Add key to agent
`ssh-add -l`	List keys in agent
`eval $(ssh-agent)`	Start the SSH agent

Key Files

File	Purpose
`~/.ssh/id_rsa`	Private key (secret!)
`~/.ssh/id_rsa.pub`	Public key (share)
`~/.ssh/authorized_keys`	Server’s list of allowed public keys
`~/.ssh/known_hosts`	Servers you’ve connected to
`~/.ssh/config`	Per-host SSH configuration

Best Practices

✅ Do This:

# Use Ed25519 keys (modern, fast, secure)
ssh-keygen -t ed25519                 # ✅

# Always set a passphrase on your private key
ssh-keygen -t ed25519                 # ✅ (enter passphrase)

# Use the SSH agent so you type it once
eval $(ssh-agent) && ssh-add          # ✅

# Copy keys with ssh-copy-id
ssh-copy-id user@host                 # ✅

# Use a config file for frequent hosts
nano ~/.ssh/config                    # ✅

# Verify host fingerprints on first connect
ssh user@host                         # ✅ (check fingerprint)

# Protect your keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub
chmod 600 ~/.ssh/authorized_keys      # ✅

❌ Don’t Do This:

# Don't share your private key
scp ~/.ssh/id_rsa someone@host        # ❌ NEVER

# Don't leave a key without a passphrase on a laptop
ssh-keygen -t rsa                     # ❌ if no passphrase

# Don't chmod 777 your .ssh directory
chmod 777 ~/.ssh                      # ❌ SSH will refuse

# Don't ignore host key warnings
# "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!"  # ❌ investigate!

# Don't use old, weak key types
ssh-keygen -t dsa                     # ❌ deprecated

# Don't email your private key
mail -s "key" me@x.com < ~/.ssh/id_rsa # ❌ NEVER

Common Pitfalls

Pitfall	Problem	Solution
Wrong permissions	SSH refuses to use key	`chmod 600 ~/.ssh/id_rsa`
Host key changed	Possible MITM	Verify fingerprint with admin
`Permission denied (publickey)`	Key not on server	Re-run `ssh-copy-id`
Agent not running	Passphrase asked every time	`eval $(ssh-agent)`
`.ssh` missing on server	Copy fails	`mkdir -p ~/.ssh` first
Wrong username	Login fails	Use correct remote user
Firewall blocks port 22	Connection times out	Open port or use another
SSH server not running	Connection refused	`sudo systemctl start sshd`

Real-World Examples

1. Connect to a Server

$ ssh kronos@192.168.1.201
kronos@192.168.1.201's password:
Welcome to Ubuntu 22.04.3 LTS
kronos@server:~$

2. Run a Command Remotely

$ ssh kronos@192.168.1.201 "df -h && free -h"
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda2       237G   45G  180G  20% /
              total        used        free      shared  buff/cache   available
Mem:           15Gi       3.2Gi       9.1Gi       123Mi       3.1Gi        11Gi
Swap:         2.0Gi          0B       2.0Gi

3. Create and Deploy a Key

$ ssh-keygen -t ed25519 -C "kronos@olympos"
$ ssh-copy-id kronos@192.168.1.201
$ ssh kronos@192.168.1.201
# No password!

4. Use an SSH Config File

$ nano ~/.ssh/config
Host server
    HostName 192.168.1.201
    User kronos
    Port 22
    IdentityFile ~/.ssh/id_ed25519

$ ssh server
# Uses all the settings above

5. Copy Files over SSH (SCP)

# Copy a local file to the server
$ scp report.pdf kronos@192.168.1.201:/home/kronos/

# Copy a file from the server to local
$ scp kronos@192.168.1.201:/var/log/syslog ./

# Copy a whole directory
$ scp -r project/ kronos@192.168.1.201:/home/kronos/

6. SSH Tunnel (Port Forwarding)

# Forward local port 8080 to remote port 80
$ ssh -L 8080:localhost:80 kronos@192.168.1.201
# Now http://localhost:8080 reaches the remote's port 80

7. Run a Command with a Remote Script

$ ssh kronos@192.168.1.201 'bash -s' < deploy.sh
# Runs deploy.sh on the remote host

8. Use `screen` or `tmux` over SSH

$ ssh kronos@192.168.1.201
kronos@server:~$ tmux new -s work
# Detach with Ctrl+B, then D
# Later, reconnect:
$ ssh kronos@192.168.1.201
kronos@server:~$ tmux attach -t work

9. Keep a Connection Alive

$ ssh -o ServerAliveInterval=60 -o ServerAliveCountMax=3 kronos@192.168.1.201

10. Disable Password Login (Server-Side)

# On the server:
$ sudo nano /etc/ssh/sshd_config
PasswordAuthentication no
PubkeyAuthentication yes

$ sudo systemctl restart sshd
# Now only key-based login works

Visual: SSH Key Authentication

┌──────────────────────────────────────────────┐
│              Your Computer                   │
│                                              │
│  ~/.ssh/id_rsa       ← private key           │
│  ~/.ssh/id_rsa.pub   ← public key            │
│                                              │
└─────────────────┬────────────────────────────┘
                  │
                  │  Step 1: ssh user@host
                  │  (public key already on server)
                  ▼
┌──────────────────────────────────────────────┐
│              Remote Server                   │
│                                              │
│  ~/.ssh/authorized_keys  ← your public key   │
│                                              │
│  Step 2: Server sends a random challenge,    │
│          encrypted with your public key      │
│                                              │
└─────────────────┬────────────────────────────┘
                  │
                  │  Step 3: Client decrypts
                  │          with private key,
                  │          sends back the answer
                  ▼
┌──────────────────────────────────────────────┐
│              Remote Server                   │
│                                              │
│  Step 4: Answer correct → login granted ✅   │
│                                              │
└──────────────────────────────────────────────┘

Summary

Command	Purpose	Example
`ssh user@host`	Connect to a remote host	`ssh kronos@192.168.1.201`
`ssh user@IP`	Connect by IP	`ssh kronos@192.168.1.201`
`ssh -p PORT user@host`	Custom port	`ssh -p 2222 kronos@host`
`ssh -i KEY user@host`	Specific key	`ssh -i ~/.ssh/id_rsa kronos@host`
`ssh user@host "CMD"`	Run a remote command	`ssh kronos@host "df -h"`
`ssh -v user@host`	Debug output	`ssh -v kronos@host`
`ssh-keygen -t rsa`	Create RSA key pair	`ssh-keygen -t rsa`
`ssh-keygen -t ed25519`	Create Ed25519 pair	`ssh-keygen -t ed25519`
`ssh-copy-id user@host`	Deploy public key	`ssh-copy-id kronos@host`
`ssh-add ~/.ssh/id_rsa`	Add key to agent	`ssh-add ~/.ssh/id_rsa`
`ssh-add -l`	List agent keys	`ssh-add -l`
`eval $(ssh-agent)`	Start SSH agent	`eval $(ssh-agent)`

Key takeaways:

SSH is the secure, encrypted way to log into remote systems
Use ssh user@host for interactive sessions and ssh user@host "CMD" for one-off commands
First connection asks you to verify the host fingerprint — accept it only if it’s correct
Install openssh-client and openssh-server for your distro
Create a key pair with ssh-keygen -t rsa (or -t ed25519 for modern keys)
Copy the public key to the server — never the private key
Use ssh-copy-id for a simpler key deployment
Use ssh-agent and ssh-add so you only type your passphrase once per session
Protect your permissions: chmod 700 ~/.ssh, chmod 600 ~/.ssh/id_rsa
Use ~/.ssh/config to store per-host settings and shorten your commands

Remember: SSH is the backbone of remote administration on Linux. The password login works, but key-based authentication is faster, safer, and script-friendly. Create a key pair, copy the public key to the server, and start the agent — after that, ssh user@host just works. Use -v when something fails, check your permissions when SSH refuses a key, and never share your private key with anyone. Master SSH, and every remote server is a keystroke away.

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!

a – ssh command

b – ssh login with SSH Key Pair

Complete Example Session

Quick Reference

ssh Basics

Installing SSH

SSH Keys

Key Files

Best Practices

Common Pitfalls

Real-World Examples

1. Connect to a Server

2. Run a Command Remotely

3. Create and Deploy a Key

4. Use an SSH Config File

5. Copy Files over SSH (SCP)

6. SSH Tunnel (Port Forwarding)

7. Run a Command with a Remote Script

8. Use screen or tmux over SSH

9. Keep a Connection Alive

10. Disable Password Login (Server-Side)

Visual: SSH Key Authentication

Summary

Ads Blocker Detected!!!

8. Use `screen` or `tmux` over SSH