LFCA 50 🐧 What SSH Is
The SSH is the Secure Shell, and it is the protocol that lets one machine reach another over an untrusted network. It is the tool that turns a remote server into a shell, and it is the tool that moves files between the two. The SSH is the modern replacement for the telnet, the rlogin, and the rsh, and it is the replacement that added the encryption. Every server administrator uses the SSH every day, and the protocol is the foundation of the remote’s work. This chapter covers what the SSH is, the client-server’s model, the encryption’s types, the host’s key, the authentication’s methods, the key’s pair, the agent, the port’s forward, and the sshd‘s configuration. It builds on LFCA 41 through 49 and prepares the ground for the SSH’s configuration’s material.
Key point: The SSH is the client-server’s protocol, and it is the encrypted’s. The client is the ssh, and the server is the sshd. The connection is the encrypted’s, and the encryption is the symmetric’s (the session’s key), the asymmetric’s (the key’s exchange), and the hash’s (the integrity’s). The host’s key is the server’s identity, and the known_hosts is the client’s record. The authentication is the password’s, the key’s pair’s, the keyboard-interactive’s, and the sshd‘s. The key’s pair is the public’s and the private’s, and the private’s is the secret’s. The agent is the ssh-agent, and it holds the private’s keys. The port’s forwarding is the tunnel’s, and the -L, the -R, the -D are the three. The sshd_config is the server’s, and the /etc/ssh/ssh_config is the client’s.
Why the SSH is the secure’s
The SSH is the secure’s, and the secure’s is the encryption’s. The telnet and the rlogin are the plain’s, and the plain’s is the password’s exposure’s. The SSH is the encrypted’s, and the encrypted’s is the safety’s.
The plain’s problem. The telnet sends the password in the plain’s, and the plain’s is the network’s capture’s. The packet’s sniffing is the attack’s, and the attack’s is the credential’s theft’s. The two are the pair, and the pair is the exposure’s.
The SSH’s answer. The SSH encrypts the session, and the session’s is the password’s and the data’s. The encryption is the safety’s, and the safety’s is the trust’s. The two are the pair, and the pair is the secure’s.
Why the SSH matters for the remote’s. The SSH is the remote’s, and the remote’s is the server’s. The server’s is the datacenter’s, and the datacenter’s is the cloud’s. The two are the pair, and the pair is the modern’s.
Why the SSH matters for the automation. The SSH is the automation’s, and the automation’s is the script’s. The scp, the sftp, the rsync, the git are the SSH’s, and the SSH’s is the transport’s. The two are the pair, and the pair is the foundation’s.
Why the SSH matters for the tunneling. The SSH is the tunneling’s, and the tunneling’s is the port’s forward’s. The -L, the -R, the -D are the three, and the three are the tunnel’s. The two are the pair, and the pair is the advanced’s.
Why the SSH matters for the key’s. The SSH is the key’s, and the key’s is the public’s and the private’s. The public’s is the server’s, and the private’s is the client’s. The two are the pair, and the pair is the authentication’s.
Why the SSH is the standard. The SSH is the standard, and the standard is the RFC’s. The RFC 4251, the 4252, the 4253, the 4254 are the four, and the four are the protocol’s. The two are the pair, and the pair is the specification’s.
Why the SSH’s versions matter. The SSH-1 is the legacy’s, and the SSH-2 is the modern’s. The SSH-1 is the deprecated’s, and the deprecated’s is the vulnerability’s. The two are the pair, and the pair is the version’s.
Why the SSH-1 is the deprecated. The SSH-1 has the vulnerability’s, and the vulnerability’s is the man-in-the-middle’s. The SSH-2 is the modern’s, and the modern’s is the safe’s. The two are the pair, and the pair is the version’s.
The client-server’s model
The SSH is the client-server’s, and the two are the roles. The client is the ssh, and the server is the sshd. The two are the pair, and the pair is the connection’s.
The client. The ssh is the client’s, and the client’s is the user’s. The ssh user@host is the command’s, and the command’s is the connection’s. The two are the pair, and the pair is the client’s.
Why the client matters. The client is the user’s, and the user’s is the entry’s. The ssh is the binary’s, and the binary’s is the /usr/bin/ssh‘s. The two are the pair, and the pair is the client’s.
The server. The sshd is the server’s, and the server’s is the daemon’s. The sshd is the service’s, and the service’s is the systemd‘s. The two are the pair, and the pair is the server’s.
Why the server matters. The server is the daemon’s, and the daemon’s is the listening’s. The sshd is the port’s 22’s, and the 22’s is the default’s. The two are the pair, and the pair is the server’s.
The connection’s flow. The client connects the server’s port 22, and the two negotiate the protocol’s version, the algorithms, and the session’s keys.
The connection's flow:
1. The TCP's handshake (the client → the server's port 22)
2. The version's exchange (the SSH-2.0-...)
3. The algorithm's negotiation
4. The key's exchange (the Diffie-Hellman)
5. The session's key's derivation
6. The client's authentication
7. The session's startThe seven are the flow’s, and the flow’s is the connection’s. The two are the pair, and the pair is the protocol’s.
Why the flow matters. The flow is the protocol’s, and the protocol’s is the model. The seven are the steps, and the steps are the connection’s. The two are the pair, and the pair is the understanding’s.
The version’s exchange. The client sends the SSH-2.0-OpenSSH_9.6, and the server responds with the SSH-2.0-OpenSSH_9.3. The two are the version’s, and the version’s is the compatible’s.
Why the version’s exchange matters. The version’s exchange is the first’s, and the first’s is the protocol’s. The two are the pair, and the pair is the model’s.
The algorithm’s negotiation. The two negotiate the key’s exchange’s algorithm, the cipher’s, the MAC’s, and the compression’s. The four are the negotiated’s, and the negotiated’s is the pair’s.
Why the algorithm’s negotiation matters. The algorithm’s negotiation is the compatibility’s, and the compatibility’s is the pair’s. The two are the pair, and the pair is the design’s.
The encryption’s types
The SSH uses the three encryption’s types: the symmetric’s, the asymmetric’s, and the hash’s. The three are the pair, and the pair is the security’s.
The symmetric’s. The symmetric’s uses the one key, and the one key’s is the session’s. The AES, the ChaCha20, the 3DES are the algorithms’s, and the algorithms’s is the cipher’s. The two are the pair, and the pair is the fast’s.
Why the symmetric’s matters. The symmetric’s is the fast’s, and the fast’s is the bulk’s data’s. The session’s key is the symmetric’s, and the symmetric’s is the message’s. The two are the pair, and the pair is the performance’s.
The asymmetric’s. The asymmetric’s uses the two keys, and the two keys’s is the public’s and the private’s. The RSA, the ECDSA, the Ed25519 are the algorithms’s, and the algorithms’s is the key’s pair’s. The two are the pair, and the pair is the slow’s.
Why the asymmetric’s matters. The asymmetric’s is the slow’s, and the slow’s is the key’s exchange’s. The public’s and the private’s are the pair’s, and the pair’s is the authentication’s. The two are the pair, and the pair is the security’s.
The hash’s. The hash’s uses the one-way’s, and the one-way’s is the integrity’s. The SHA-256, the SHA-512, the HMAC are the algorithms’s, and the algorithms’s is the MAC’s. The two are the pair, and the pair is the integrity’s.
Why the hash’s matters. The hash’s is the integrity’s, and the integrity’s is the tamper’s detection’s. The MAC is the hash’s, and the hash’s is the message’s. The two are the pair, and the pair is the safety’s.
The three’s combination. The three combine the symmetric’s (the session’s), the asymmetric’s (the key’s exchange’s and the authentication’s), and the hash’s (the integrity’s). The three are the pair, and the pair is the SSH’s.
Why the three’s combination matters. The three’s combination is the SSH’s, and the SSH’s is the secure’s. The symmetric’s, the asymmetric’s, the hash’s are the three, and the three are the protocol’s. The two are the pair, and the pair is the security’s.
The host’s key
The host’s key is the server’s identity, and the known_hosts is the client’s record. The two are the pair, and the pair is the trust’s.
The host’s key. The sshd generates the host’s key at the install’s, and the key’s is the server’s identity’s. The /etc/ssh/ssh_host_*_key is the private’s, and the /etc/ssh/ssh_host_*_key.pub is the public’s. The two are the pair, and the pair is the identity’s.
Why the host’s key matters. The host’s key is the server’s identity’s, and the identity’s is the trust’s. The client’s verifies the host’s key, and the verification’s is the man-in-the-middle’s prevention’s. The two are the pair, and the pair is the security’s.
The known_hosts. The ~/.ssh/known_hosts is the client’s record’s, and the record’s is the host’s key’s. The first’s connection’s prompts the user, and the user’s confirms the key’s. The two are the pair, and the pair is the trust’s.
Why the known_hosts matters. The known_hosts is the client’s, and the client’s is the record’s. The record’s is the future’s verification’s, and the verification’s is the change’s detection’s. The two are the pair, and the pair is the safety’s.
The man-in-the-middle’s attack. The attacker’s is the host’s key’s replacement’s, and the replacement’s is the client’s fooling’s. The known_hosts‘s is the detection’s, and the detection’s is the warning’s. The two are the pair, and the pair is the security’s.
Why the man-in-the-middle matters. The man-in-the-middle is the attack’s, and the attack’s is the trust’s. The known_hosts is the prevention’s, and the prevention’s is the verification’s. The two are the pair, and the pair is the safety’s.
The StrictHostKeyChecking. The StrictHostKeyChecking=yes is the strict’s, and the strict’s is the refuse’s. The accept-new is the modern’s, and the modern’s is the balance’s. The two are the pair, and the pair is the policy’s.
Why the StrictHostKeyChecking matters. The StrictHostKeyChecking is the policy’s, and the policy’s is the security’s. The yes is the strict’s, and the accept-new is the convenient’s. The two are the pair, and the pair is the choice’s.
The host’s key’s rotation. The host’s key can be the rotated’s, and the rotated’s is the ssh-keygen -A‘s. The two are the pair, and the pair is the maintenance’s.
Why the host’s key’s rotation matters. The rotation is the maintenance’s, and the maintenance’s is the security’s. The ssh-keygen -A is the regenerate’s, and the regenerate’s is the all’s. The two are the pair, and the pair is the pattern’s.
The authentication’s methods
The SSH’s authentication’s methods are the password’s, the key’s pair’s, the keyboard-interactive’s, and the sshd‘s. The four are the common, and the common is the authentication’s.
The password’s. The password’s is the simplest’s, and the simplest’s is the password’s. The client’s sends the password, and the password’s is the server’s verification’s. The two are the pair, and the pair is the basic’s.
Why the password’s matters. The password’s is the basic’s, and the basic’s is the common’s. The password’s is the convenient’s, and the convenient’s is the weak’s. The two are the pair, and the pair is the choice’s.
The key’s pair’s. The key’s pair’s is the public’s and the private’s, and the two are the pair’s. The client’s proves the private’s, and the server’s verifies the public’s. The two are the pair, and the pair is the modern’s.
Why the key’s pair matters. The key’s pair is the modern’s, and the modern’s is the secure’s. The private’s is the secret’s, and the public’s is the shareable’s. The two are the pair, and the pair is the authentication’s.
The keyboard-interactive’s. The keyboard-interactive’s is the prompts’s, and the prompts’s is the PAM’s. The server’s sends the prompts, and the client’s responds. The two are the pair, and the pair is the MFA’s.
Why the keyboard-interactive matters. The keyboard-interactive is the MFA’s, and the MFA’s is the second’s factor’s. The TOTP’s is the example’s, and the example’s is the modern’s. The two are the pair, and the pair is the security’s.
The sshd‘s. The sshd‘s is the server’s, and the server’s is the daemon’s. The sshd‘s is the service’s, and the service’s is the systemd‘s. The two are the pair, and the pair is the server’s.
Why the sshd‘s matters. The sshd‘s is the server’s, and the server’s is the configuration’s. The sshd_config is the file’s, and the file’s is the policy’s. The two are the pair, and the pair is the design’s.
The methods’s choice. The methods’s choice is the server’s, and the server’s is the configuration’s. The PasswordAuthentication no is the key’s pair’s, and the key’s pair’s is the recommended’s. The two are the pair, and the pair is the security’s.
Why the methods’s choice matters. The methods’s choice is the security’s, and the security’s is the design’s. The password’s is the convenient’s, and the key’s pair’s is the secure’s. The two are the pair, and the pair is the recommendation’s.
The key’s pair
The key’s pair is the public’s and the private’s, and the two are the modern’s authentication’s. The private’s is the secret’s, and the public’s is the shareable’s.
The generation. The ssh-keygen -t ed25519 -C "comment" is the generation’s, and the generation’s is the modern’s.
ssh-keygen -t ed25519 -C "user@host"
# Generating public/private ed25519 key pair.
# Enter file in which to save the key (/home/user/.ssh/id_ed25519):
# Enter passphrase (empty for no passphrase):
# Enter same passphrase again:
# Your identification has been saved in /home/user/.ssh/id_ed25519
# Your public key has been saved in /home/user/.ssh/id_ed25519.pubThe ssh-keygen -t ed25519 is the generation’s, and the generation’s is the Ed25519’s. The ~/.ssh/id_ed25519 is the private’s, and the ~/.ssh/id_ed25519.pub is the public’s. The two are the pair, and the pair is the key’s.
Why the generation matters. The generation is the first’s, and the first’s is the key’s. The ed25519 is the modern’s, and the modern’s is the recommended’s. The two are the pair, and the pair is the algorithm’s.
The algorithm’s choice. The ed25519 is the modern’s, the rsa is the legacy’s, the ecdsa is the alternative’s. The three are the common, and the common is the algorithm’s.
Why the algorithm’s choice matters. The algorithm’s choice is the security’s, and the security’s is the key’s length’s. The ed25519 is the 256-bit’s, and the rsa is the 2048-bit’s or the 4096-bit’s. The two are the pair, and the pair is the modern’s.
The public’s key’s copy. The ssh-copy-id user@host is the copy’s, and the copy’s is the server’s.
ssh-copy-id user@host
# /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s)
# Number of key(s) added: 1The ssh-copy-id user@host is the copy’s, and the copy’s is the ~/.ssh/authorized_keys‘s. The Number of key(s) added: 1 is the confirmation’s, and the confirmation’s is the success’s. The two are the pair, and the pair is the pattern’s.
Why the copy’s matters. The copy’s is the public’s, and the public’s is the server’s. The authorized_keys is the file’s, and the file’s is the permission’s. The two are the pair, and the pair is the authentication’s.
The private’s key’s permission. The chmod 600 ~/.ssh/id_ed25519 is the permission’s, and the permission’s is the private’s.
chmod 600 ~/.ssh/id_ed25519
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keysThe 600 is the private’s, the 700 is the directory’s, the 600 is the authorized_keys‘s. The three are the permission’s, and the permission’s is the requirement’s. The two are the pair, and the pair is the safety’s.
Why the permission matters. The permission is the requirement’s, and the requirement’s is the sshd‘s. The sshd refuses the loose’s permission, and the refuse’s is the safety’s. The two are the pair, and the pair is the security’s.
The authorized_keys‘s format. The ~/.ssh/authorized_keys has the public’s keys, and the keys’s are the one’s per line. The format is the [options] key-type base64-key comment.
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... user@hostThe ssh-ed25519 is the type’s, the AAAAC3... is the key’s, the user@host is the comment’s. The three are the line’s, and the line’s is the format’s. The two are the pair, and the pair is the standard’s.
Why the authorized_keys‘s format matters. The format is the standard’s, and the standard’s is the sshd‘s. The options’s is the restriction’s, and the restriction’s is the from=, the command=, the no-pty‘s. The two are the pair, and the pair is the advanced’s.
The authorized_keys‘s options. The from="192.168.1.0/24" restricts the source’s, and the command="/usr/bin/backup" restricts the command’s. The two are the pair, and the pair is the security’s.
from="192.168.1.0/24",command="/usr/bin/backup" ssh-ed25519 AAAA... backup@hostThe from and the command are the options’s, and the options’s is the restriction’s. The two are the pair, and the pair is the security’s.
Why the options matter. The options are the security’s, and the security’s is the restriction’s. The from is the source’s, and the command is the command’s. The two are the pair, and the pair is the least’s privilege’s.
The agent
The ssh-agent holds the private’s keys, and the ssh-add adds the keys’s. The two are the pair, and the pair is the convenience’s.
The agent’s role. The ssh-agent is the daemon’s, and the daemon’s is the keys’s. The agent’s holds the decrypted’s keys’s, and the keys’s is the passphrase’s. The two are the pair, and the pair is the convenience’s.
Why the agent matters. The agent is the convenience’s, and the convenience’s is the passphrase’s. The agent’s is the once’s, and the once’s is the many’s. The two are the pair, and the pair is the ergonomics’s.
The ssh-add. The ssh-add ~/.ssh/id_ed25519 is the addition’s, and the addition’s is the agent’s.
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
# Enter passphrase for /home/user/.ssh/id_ed25519:
# Identity added: /home/user/.ssh/id_ed25519 (user@host)The eval "$(ssh-agent -s)" is the start’s, and the start’s is the agent’s. The ssh-add ~/.ssh/id_ed25519 is the addition’s, and the addition’s is the key’s. The two are the pair, and the pair is the pattern’s.
Why the ssh-add matters. The ssh-add is the addition’s, and the addition’s is the key’s. The passphrase’s is the once’s, and the once’s is the session’s. The two are the pair, and the pair is the convenience’s.
The ssh-add -l. The ssh-add -l is the list’s, and the list’s is the keys’s.
ssh-add -l
# 256 SHA256:... user@host (ED25519)The ssh-add -l is the list’s, and the list’s is the keys’s. The 256 SHA256:... is the key’s, and the key’s is the fingerprint’s. The two are the pair, and the pair is the audit’s.
Why the ssh-add -l matters. The ssh-add -l is the list’s, and the list’s is the audit’s. The keys’s is the agent’s, and the agent’s is the session’s. The two are the pair, and the pair is the diagnosis’s.
The agent’s forwarding. The ForwardAgent yes is the forwarding’s, and the forwarding’s is the remote’s.
# In the ~/.ssh/config:
Host example.com
ForwardAgent yesThe ForwardAgent yes is the forwarding’s, and the forwarding’s is the remote’s. The remote’s is the agent’s, and the agent’s is the chain’s. The two are the pair, and the pair is the pattern’s.
Why the agent’s forwarding matters. The forwarding is the chain’s, and the chain’s is the jump’s. The ForwardAgent is the convenient’s, and the convenient’s is the risk’s. The two are the pair, and the pair is the security’s.
Why the forwarding is the risky. The forwarding is the risky’s, and the risky’s is the root’s. The remote’s root can use the agent’s, and the agent’s is the keys’s. The two are the pair, and the pair is the security’s.
The port’s forwarding
The port’s forwarding is the tunnel’s, and the three are the -L, the -R, the -D. The three are the common, and the common is the tunnel’s.
The -L (the local’s). The ssh -L 8080:localhost:80 user@host is the local’s, and the local’s is the forward’s.
ssh -L 8080:localhost:80 user@host
# The local's 8080 → the remote's 80The -L 8080:localhost:80 is the local’s, and the local’s is the forward’s. The local’s 8080 is the entry’s, and the remote’s 80 is the destination’s. The two are the pair, and the pair is the tunnel’s.
Why the -L matters. The -L is the local’s, and the local’s is the access’s. The database’s is the 5432’s, and the 5432’s is the forward’s. The two are the pair, and the pair is the tunnel’s.
The -R (the remote’s). The ssh -R 8080:localhost:80 user@host is the remote’s, and the remote’s is the reverse’s.
ssh -R 8080:localhost:80 user@host
# The remote's 8080 → the local's 80The -R 8080:localhost:80 is the remote’s, and the remote’s is the reverse’s. The remote’s 8080 is the entry’s, and the local’s 80 is the destination’s. The two are the pair, and the pair is the tunnel’s.
Why the -R matters. The -R is the remote’s, and the remote’s is the reverse’s. The local’s service is the exposed’s, and the exposed’s is the remote’s. The two are the pair, and the pair is the pattern’s.
The -D (the dynamic’s). The ssh -D 1080 user@host is the dynamic’s, and the dynamic’s is the SOCKS’s.
ssh -D 1080 user@host
# The local's 1080 → the SOCKS's proxyThe -D 1080 is the dynamic’s, and the dynamic’s is the SOCKS’s. The local’s 1080 is the proxy’s, and the proxy’s is the SOCKS’s. The two are the pair, and the pair is the tunnel’s.
Why the -D matters. The -D is the SOCKS’s, and the SOCKS’s is the browser’s. The browser’s is the proxy’s, and the proxy’s is the remote’s. The two are the pair, and the pair is the pattern’s.
The jump’s host. The ssh -J jump user@host is the jump’s, and the jump’s is the bastion’s.
ssh -J user@jump user@hostThe -J user@jump is the jump’s, and the jump’s is the bastion’s. The bastion’s is the internal’s, and the internal’s is the access’s. The two are the pair, and the pair is the pattern’s.
Why the jump’s host matters. The jump’s host is the bastion’s, and the bastion’s is the internal’s. The -J is the modern’s, and the modern’s is the concise’s. The two are the pair, and the pair is the pattern’s.
The ProxyJump‘s config. The ProxyJump jump is the config’s, and the config’s is the persistent’s.
# In the ~/.ssh/config:
Host internal
HostName 10.0.0.5
ProxyJump jump.example.comThe ProxyJump jump.example.com is the config’s, and the config’s is the persistent’s. The internal is the alias’s, and the alias’s is the convenience’s. The two are the pair, and the pair is the pattern’s.
Why the ProxyJump matters. The ProxyJump is the config’s, and the config’s is the persistent’s. The -J is the command’s, and the ProxyJump is the file’s. The two are the pair, and the pair is the modern’s.
The configuration
The configuration is the sshd_config‘s (the server’s) and the ssh_config‘s (the client’s). The two are the pair, and the pair is the policy’s.
The sshd_config. The /etc/ssh/sshd_config is the server’s, and the server’s is the policy’s.
# /etc/ssh/sshd_config
Port 22
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AllowUsers alice bobThe Port 22 is the port’s, the PermitRootLogin no is the root’s, the PasswordAuthentication no is the password’s, the PubkeyAuthentication yes is the key’s, the AllowUsers alice bob is the users’s. The five are the policy’s, and the policy’s is the security’s. The two are the pair, and the pair is the design’s.
Why the sshd_config matters. The sshd_config is the server’s, and the server’s is the policy’s. The PermitRootLogin no is the root’s, and the root’s is the direct’s login’s prevention’s. The two are the pair, and the pair is the security’s.
The ssh_config. The /etc/ssh/ssh_config is the client’s, and the client’s is the defaults’s.
# /etc/ssh/ssh_config
Host *
SendEnv LANG LC_*
HashKnownHosts yes
GSSAPIAuthentication yesThe Host * is the all’s, the SendEnv is the environment’s, the HashKnownHosts is the hash’s, the GSSAPIAuthentication is the GSSAPI’s. The four are the defaults’s, and the defaults’s is the client’s. The two are the pair, and the pair is the configuration’s.
Why the ssh_config matters. The ssh_config is the client’s, and the client’s is the defaults’s. The Host * is the all’s, and the all’s is the defaults’s. The two are the pair, and the pair is the design’s.
The user’s config. The ~/.ssh/config is the user’s, and the user’s is the per-user’s.
# ~/.ssh/config
Host example
HostName example.com
User alice
Port 2222
IdentityFile ~/.ssh/id_ed25519The Host example is the alias’s, the HostName example.com is the host’s, the User alice is the user’s, the Port 2222 is the port’s, the IdentityFile ~/.ssh/id_ed25519 is the key’s. The five are the per-user’s, and the per-user’s is the convenience’s. The two are the pair, and the pair is the pattern’s.
Why the user’s config matters. The user’s config is the convenience’s, and the convenience’s is the alias’s. The ssh example is the alias’s, and the alias’s is the full’s. The two are the pair, and the pair is the ergonomics’s.
The Match‘s block. The Match is the conditional’s, and the conditional’s is the specific’s.
Match User alice
AllowTcpForwarding yesThe Match User alice is the conditional’s, and the conditional’s is the specific’s. The AllowTcpForwarding yes is the forwarding’s, and the forwarding’s is the alice’s. The two are the pair, and the pair is the design’s.
Why the Match matters. The Match is the conditional’s, and the conditional’s is the specific’s. The Match is the advanced’s, and the advanced’s is the per-user’s. The two are the pair, and the pair is the design’s.
The configuration’s reload. The sudo systemctl reload sshd is the reload’s, and the reload’s is the apply’s.
sudo systemctl reload sshdThe sudo systemctl reload sshd is the reload’s, and the reload’s is the apply’s. The two are the pair, and the pair is the pattern’s.
Why the reload’s matters. The reload is the apply’s, and the apply’s is the configuration’s. The reload is the graceful’s, and the graceful’s is the existing’s. The two are the pair, and the pair is the modern’s.
Complete Example Session
# ============================================
# PART 1: THE SSH'S BASIC
# ============================================
ssh user@example.com
# The password's prompt, or the key's authentication.
ssh -p 2222 user@example.com
# The port's 2222.
# ============================================
# PART 2: THE KEY'S GENERATION
# ============================================
ssh-keygen -t ed25519 -C "user@host"
# Generating public/private ed25519 key pair.
# Enter file in which to save the key (/home/user/.ssh/id_ed25519):
# Enter passphrase (empty for no passphrase):
# Your identification has been saved in /home/user/.ssh/id_ed25519
# Your public key has been saved in /home/user/.ssh/id_ed25519.pub
# ============================================
# PART 3: THE PUBLIC'S KEY'S COPY
# ============================================
ssh-copy-id user@example.com
# Number of key(s) added: 1
# ============================================
# PART 4: THE PERMISSION
# ============================================
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 600 ~/.ssh/authorized_keys
# ============================================
# PART 5: THE AGENT
# ============================================
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
# Enter passphrase for /home/user/.ssh/id_ed25519:
# Identity added: /home/user/.ssh/id_ed25519 (user@host)
ssh-add -l
# 256 SHA256:... user@host (ED25519)
# ============================================
# PART 6: THE CONFIG
# ============================================
# ~/.ssh/config
# Host example
# HostName example.com
# User alice
# Port 2222
# IdentityFile ~/.ssh/id_ed25519
ssh example
# The alias's connection.
# ============================================
# PART 7: THE PORT'S FORWARDING
# ============================================
ssh -L 8080:localhost:80 user@example.com
# The local's 8080 → the remote's 80.
ssh -R 8080:localhost:80 user@example.com
# The remote's 8080 → the local's 80.
ssh -D 1080 user@example.com
# The local's 1080 → the SOCKS's.
# ============================================
# PART 8: THE JUMP'S HOST
# ============================================
ssh -J user@jump user@internal
# The jump's host.
# ============================================
# PART 9: THE SSHD_CONFIG
# ============================================
# /etc/ssh/sshd_config
# Port 22
# PermitRootLogin no
# PasswordAuthentication no
# PubkeyAuthentication yes
# AllowUsers alice bob
sudo systemctl reload sshd
# ============================================
# PART 10: WHAT NOT TO DO
# ============================================
# Don't use the password's authentication on the public's
PasswordAuthentication yes // ⚠️
# Don't allow the root's login
PermitRootLogin yes // ⚠️
# Don't use the loose's permission
chmod 644 ~/.ssh/id_ed25519 // ⚠️
# Don't use the SSH-1
# The deprecated's.
# Don't forget the StrictHostKeyChecking
# The man-in-the-middle's.
# Don't forward the agent to the untrusted's
ForwardAgent yes // ⚠️The ten parts cover the SSH’s basic, the key’s generation, the public’s key’s copy, the permission, the agent, the config, the port’s forwarding, the jump’s host, the sshd_config, and the anti-patterns.
Quick Reference
The SSH’s Commands
| The command | The purpose |
|---|---|
The ssh user@host | The connection |
The ssh -p 2222 | The port’s |
The ssh -i key | The key’s |
The ssh -L | The local’s forward |
The ssh -R | The remote’s forward |
The ssh -D | The dynamic’s |
The ssh -J | The jump’s |
The ssh -v | The verbose’s |
The Key’s Commands
| The command | The purpose |
|---|---|
The ssh-keygen -t ed25519 | The generation |
The ssh-copy-id | The public’s copy |
The ssh-add | The agent’s addition |
The ssh-add -l | The agent’s list |
The ssh-keygen -l -f key | The fingerprint |
The Key’s Files
| The file | The purpose |
|---|---|
The ~/.ssh/id_ed25519 | The private |
The ~/.ssh/id_ed25519.pub | The public |
The ~/.ssh/authorized_keys | The server’s keys |
The ~/.ssh/known_hosts | The client’s record |
The ~/.ssh/config | The client’s config |
The /etc/ssh/sshd_config | The server’s config |
The /etc/ssh/ssh_config | The client’s default |
The Encryption’s Types
| The type | The purpose |
|---|---|
| The symmetric’s | The session’s bulk |
| The asymmetric’s | The key’s exchange, the authentication |
| The hash’s | The integrity |
The Authentication’s Methods
| The method | The security |
|---|---|
| The password’s | The weak |
| The key’s pair’s | The strong |
| The keyboard-interactive’s | The MFA |
The Port’s Forwarding
| The flag | The purpose |
|---|---|
The -L | The local’s |
The -R | The remote’s |
The -D | The dynamic’s SOCKS |
The Permission’s Rules
| The file | The mode |
|---|---|
The ~/.ssh | The 700 |
The ~/.ssh/id_ed25519 | The 600 |
The ~/.ssh/authorized_keys | The 600 |
Best Practices
✅ Do This:
# Use the ed25519's key
ssh-keygen -t ed25519 -C "user@host" # ✅
# Copy the public's key
ssh-copy-id user@host # ✅
# Set the permission
chmod 700 ~/.ssh && chmod 600 ~/.ssh/id_ed25519 # ✅
# Use the agent
eval "$(ssh-agent -s)" && ssh-add ~/.ssh/id_ed25519 # ✅
# Disable the root's login
PermitRootLogin no # ✅
# Disable the password's authentication
PasswordAuthentication no # ✅
# Use the config's alias
ssh example # the ~/.ssh/config's # ✅
# Use the jump's host
ssh -J user@jump user@internal # ✅❌ Don’t Do This:
# Don't use the password's authentication on the public's
PasswordAuthentication yes // ⚠️
# Don't allow the root's login
PermitRootLogin yes // ⚠️
# Don't use the loose's permission
chmod 644 ~/.ssh/id_ed25519 // ⚠️
# Don't use the SSH-1
# The deprecated's. // ⚠️
# Don't forget the StrictHostKeyChecking
# The man-in-the-middle's. // ⚠️
# Don't forward the agent to the untrusted's
ForwardAgent yes // ⚠️Common Pitfalls
| Pitfall | Problem | Solution |
|---|---|---|
| The password’s auth | The weak | The key’s pair |
| The root’s login | The risk | The PermitRootLogin no |
| The loose’s permission | The sshd‘s refusal | The chmod 600 |
| The SSH-1 | The deprecated | The SSH-2 |
| The man-in-the-middle | The attack | The known_hosts |
| The agent’s forwarding | The risk | The no |
| The missing key | The password’s | The ssh-keygen |
| The wrong port | The refused | The -p |
Real-World Examples
1. The basic connection
ssh user@example.com2. The key’s generation
ssh-keygen -t ed25519 -C "user@host"3. The public’s copy
ssh-copy-id user@example.com4. The permission
chmod 600 ~/.ssh/id_ed255195. The agent
ssh-add ~/.ssh/id_ed255196. The config’s alias
ssh example7. The port’s forwarding
ssh -L 8080:localhost:80 user@example.com8. The jump’s host
ssh -J user@jump user@internal9. The server’s config
sudo systemctl reload sshd10. The verbose’s
ssh -v user@example.comVisual: The SSH’s Flow
┌──────────────────────────────────────────────────────────┐
│ THE CLIENT │
│ │ │
│ │ 1. The TCP's handshake │
│ │ 2. The version's exchange │
│ │ 3. The algorithm's negotiation │
│ │ 4. The key's exchange │
│ │ 5. The session's key's derivation │
│ │ 6. The client's authentication │
│ │ 7. The session's start │
│ ▼ │
│ THE SERVER (the port 22) │
│ │
│ The seven are the flow's, and the flow's is the │
│ connection's. │
│ │
└──────────────────────────────────────────────────────────┘Visual: The Encryption’s Types
┌──────────────────────────────────────────────────────────┐
│ THE SYMMETRIC'S │
│ The one key (the session's). │
│ The AES, the ChaCha20. │
│ The fast's, the bulk's. │
│ │
├──────────────────────────────────────────────────────────┤
│ THE ASYMMETRIC'S │
│ The two keys (the public's and the private's). │
│ The RSA, the ECDSA, the Ed25519. │
│ The slow's, the key's exchange's. │
│ │
├──────────────────────────────────────────────────────────┤
│ THE HASH'S │
│ The one-way's. │
│ The SHA-256, the HMAC. │
│ The integrity's. │
│ │
│ The three are the pair, and the pair is the SSH's. │
│ │
└──────────────────────────────────────────────────────────┘Visual: The Authentication’s Methods
┌──────────────────────────────────────────────────────────┐
│ THE PASSWORD'S │
│ The simplest's. │
│ The weak's. │
│ │
├──────────────────────────────────────────────────────────┤
│ THE KEY'S PAIR'S │
│ The public's and the private's. │
│ The strong's. │
│ The recommended's. │
│ │
├──────────────────────────────────────────────────────────┤
│ THE KEYBOARD-INTERACTIVE'S │
│ The prompts's. │
│ The MFA's. │
│ │
│ The key's pair's is the modern's, and the modern's is │
│ the secure's. │
│ │
└──────────────────────────────────────────────────────────┘Visual: The Key’s Pair
┌──────────────────────────────────────────────────────────┐
│ THE PRIVATE'S KEY │
│ The ~/.ssh/id_ed25519 │
│ The secret's. │
│ The never's shared's. │
│ │
├──────────────────────────────────────────────────────────┤
│ THE PUBLIC'S KEY │
│ The ~/.ssh/id_ed25519.pub │
│ The shareable's. │
│ The server's authorized_keys. │
│ │
│ THE FLOW │
│ 1. The client's proves the private's. │
│ 2. The server's verifies the public's. │
│ 3. The authentication's. │
│ │
│ The two are the pair, and the pair is the modern's. │
│ │
└──────────────────────────────────────────────────────────┘Visual: The Port’s Forwarding
┌──────────────────────────────────────────────────────────┐
│ THE -L (THE LOCAL'S) │
│ ssh -L 8080:localhost:80 user@host │
│ The local's 8080 → the remote's 80. │
│ The access's. │
│ │
├──────────────────────────────────────────────────────────┤
│ THE -R (THE REMOTE'S) │
│ ssh -R 8080:localhost:80 user@host │
│ The remote's 8080 → the local's 80. │
│ The reverse's. │
│ │
├──────────────────────────────────────────────────────────┤
│ THE -D (THE DYNAMIC'S) │
│ ssh -D 1080 user@host │
│ The local's 1080 → the SOCKS's. │
│ The browser's. │
│ │
│ The three are the tunnel's, and the tunnel's is the │
│ SSH's. │
│ │
└──────────────────────────────────────────────────────────┘Visual: The Jump’s Host
┌──────────────────────────────────────────────────────────┐
│ WITHOUT THE JUMP │
│ The client → the internal's (the unreachable's). │
│ │
├──────────────────────────────────────────────────────────┤
│ WITH THE JUMP │
│ The client → the jump's → the internal's. │
│ The jump's is the bastion's. │
│ The internal's is the reachable's. │
│ │
│ THE COMMANDS │
│ ssh -J user@jump user@internal │
│ The ~/.ssh/config's ProxyJump. │
│ │
│ The jump's is the pattern's. │
│ │
└──────────────────────────────────────────────────────────┘Summary
| Item | Value |
|---|---|
| The SSH | The Secure Shell |
| The client | The ssh |
| The server | The sshd |
| The port | The 22 |
| The encryption’s | The symmetric’s, the asymmetric’s, the hash’s |
| The host’s key | The server’s identity |
The known_hosts | The client’s record |
| The authentication | The password’s, the key’s pair’s, the keyboard-interactive’s |
| The key’s pair | The public’s and the private’s |
| The agent | The ssh-agent |
| The port’s forwarding | The -L, the -R, the -D |
| The jump’s | The -J, the ProxyJump |
Key takeaways:
- The SSH is the client-server’s protocol, and it is the encrypted’s — the
sshis the client, and thesshdis the server - The connection’s flow is the seven steps — the TCP’s handshake, the version’s exchange, the algorithm’s negotiation, the key’s exchange, the session’s key’s derivation, the authentication, the session’s start
- The encryption’s three types are the symmetric’s, the asymmetric’s, and the hash’s — the symmetric’s is the bulk’s, the asymmetric’s is the key’s exchange’s, and the hash’s is the integrity’s
- The host’s key is the server’s identity — the
known_hostsis the client’s record, and the verification is the man-in-the-middle’s prevention’s - The authentication’s methods are the password’s, the key’s pair’s, the keyboard-interactive’s, and the
sshd‘s — the key’s pair’s is the modern’s, and the password’s is the weak’s - The key’s pair is the public’s and the private’s — the private’s is the secret’s, and the public’s is the
authorized_keys‘s - The
ssh-agentholds the private’s keys — thessh-addadds the keys’s, and the passphrase’s is the once’s - The port’s forwarding is the
-L, the-R, the-D— the-Lis the local’s, the-Ris the remote’s, and the-Dis the SOCKS’s - The jump’s host is the bastion’s — the
-Jis the command’s, and theProxyJumpis the config’s - The
sshd_configis the server’s, and thessh_configis the client’s — thePermitRootLogin noand thePasswordAuthentication noare the secure’s
Remember: The SSH is the secure shell, and it is the encrypted’s. The client is the ssh, and the server is the sshd. The encryption’s is the three’s, and the host’s key is the identity’s. The authentication’s is the key’s pair’s, and the private’s is the secret’s. The agent is the convenience’s, and the forwarding is the tunnel’s. The jump’s is the bastion’s, and the config is the policy’s. The SSH is the standard, and the standard is the secure’s.
Stop using slow, ad-bloated tool sites! 🤮
🔎 Search “KandZ Tools” on Google to use many professional utilities for free.
KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)
⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free
🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!