sshLog in to remote servers securely
ssh opens an encrypted, authenticated session to another machine: an interactive shell, a single remote command, or a tunnel that forwards ports through it. Every server you manage is reached this way, usually with key pairs and often through a bastion host.
ssh [-i KEY] [-p PORT] [-J JUMPHOST] [-L|-R|-D FORWARD] [-N] [-v] [USER@]HOST [COMMAND]You've been given access to a new bastion host and log in for the first time.
sshThe OpenSSH client. It reads ~/.ssh/config and /etc/ssh/ssh_config for defaults per host.
ssh opens a TCP connection to port 22 and both sides exchange version banners (SSH-2.0-OpenSSH_9.6...). They agree on algorithms and run a key exchange (sntrup761x25519 or curve25519 in current OpenSSH) that gives both ends the same session keys without ever sending them; from then on everything is encrypted. The server proves its identity by signing the exchange with its host key, and the client compares that key with ~/.ssh/known_hosts: unknown keys trigger the 'authenticity can't be established' prompt, changed keys a loud warning. Then the user authenticates. With public keys, the client offers a public key, the server checks it is listed in ~/.ssh/authorized_keys of the target user, and the client proves it holds the private key by signing a challenge (the private key never leaves your machine; ssh-agent can do the signing). Finally ssh opens channels inside the connection: a shell with a pseudo-terminal, a remote command, or forwarded TCP ports.
Key exchange encrypts the session, the host key proves the server, a signature proves you, then channels carry the shell or a tunnel.
ssh opens TCP to port 22. Both sides send a version banner such as SSH-2.0-OpenSSH_9.6p1 and list the algorithms they support.
-i FILEIdentity (private key) file to use-p PORTConnect to this port instead of 22-J user@hostJump through a bastion host first (ProxyJump)-L lport:host:hportLocal forward: localhost:lport -> host:hport via the server-R rport:host:hportRemote forward: server's rport -> host:hport via you-D 1080Dynamic SOCKS proxy on localhost:1080 through the server-N / -fNo remote command (tunnel only) / go to background after auth-v / -vvvVerbose debug output: keys tried, algorithms, why auth failed-tForce a terminal, for interactive remote commands like top or sudo-AForward your ssh-agent (only to hosts you trust)-o Key=ValueAny config option, e.g. -o ConnectTimeout=5, StrictHostKeyChecking=accept-new-CCompress traffic (helps on slow links)rm ~/.ssh/known_hosts to get past a host key warningIt discards every verified key at once, and you lose the protection against man-in-the-middle attacks for all hosts.
ssh-keygen -R 10.0.2.15 # after verifying the new keychmod 644 on a private key, or 777 on ~/.ssh on the serverssh refuses world-readable private keys, and sshd (StrictModes) ignores authorized_keys when the home, .ssh or file are writable by others.
chmod 600 ~/.ssh/id_ed25519; chmod 700 ~/.ssh; chmod 600 ~/.ssh/authorized_keysssh -A to every host to use your key further onAnyone with root on that host can use your forwarded agent to log in as you elsewhere while you're connected.
ssh -J bastion app-1 # ProxyJump keeps the key on your machineCopying the private key onto the bastion to hop furtherThe key now lives on a shared server where other admins and attackers can reach it.
Use ProxyJump (-J) or a ~/.ssh/config ProxyJump line.ssh host sudo systemctl restart app in a script, and it hangssudo asks for a password, and without a terminal it can't prompt or waits forever.
ssh -t host sudo ... interactively, or allow that command with NOPASSWD in sudoers for automationTry these on a Linux machine of your own. Each task has a hint and a solution.
Is an SSH server running in this sandbox? Check with ss whether anything listens on port 22. (In the practice sandbox ss first prints a "Cannot open netlink socket" warning, then the sockets.)
Create an ed25519 key pair with no passphrase at ~/.ssh/lab_key and show the permissions of both files.
Write a ~/.ssh/config entry so that 'ssh web' connects as ubuntu to 10.0.2.20 with ~/.ssh/lab_key through the host 'bastion'.
Write the command that forwards your local port 8080 to port 80 of 10.0.2.20 through the host bastion, in the background, with no remote shell.
sshLog in to remote servers securely
ssh opens an encrypted, authenticated session to another machine: an interactive shell, a single remote command, or a tunnel that forwards ports through it. Every server you manage is reached this way, usually with key pairs and often through a bastion host.
ssh [-i KEY] [-p PORT] [-J JUMPHOST] [-L|-R|-D FORWARD] [-N] [-v] [USER@]HOST [COMMAND]You've been given access to a new bastion host and log in for the first time.
sshThe OpenSSH client. It reads ~/.ssh/config and /etc/ssh/ssh_config for defaults per host.
ssh opens a TCP connection to port 22 and both sides exchange version banners (SSH-2.0-OpenSSH_9.6...). They agree on algorithms and run a key exchange (sntrup761x25519 or curve25519 in current OpenSSH) that gives both ends the same session keys without ever sending them; from then on everything is encrypted. The server proves its identity by signing the exchange with its host key, and the client compares that key with ~/.ssh/known_hosts: unknown keys trigger the 'authenticity can't be established' prompt, changed keys a loud warning. Then the user authenticates. With public keys, the client offers a public key, the server checks it is listed in ~/.ssh/authorized_keys of the target user, and the client proves it holds the private key by signing a challenge (the private key never leaves your machine; ssh-agent can do the signing). Finally ssh opens channels inside the connection: a shell with a pseudo-terminal, a remote command, or forwarded TCP ports.
Key exchange encrypts the session, the host key proves the server, a signature proves you, then channels carry the shell or a tunnel.
ssh opens TCP to port 22. Both sides send a version banner such as SSH-2.0-OpenSSH_9.6p1 and list the algorithms they support.
-i FILEIdentity (private key) file to use-p PORTConnect to this port instead of 22-J user@hostJump through a bastion host first (ProxyJump)-L lport:host:hportLocal forward: localhost:lport -> host:hport via the server-R rport:host:hportRemote forward: server's rport -> host:hport via you-D 1080Dynamic SOCKS proxy on localhost:1080 through the server-N / -fNo remote command (tunnel only) / go to background after auth-v / -vvvVerbose debug output: keys tried, algorithms, why auth failed-tForce a terminal, for interactive remote commands like top or sudo-AForward your ssh-agent (only to hosts you trust)-o Key=ValueAny config option, e.g. -o ConnectTimeout=5, StrictHostKeyChecking=accept-new-CCompress traffic (helps on slow links)rm ~/.ssh/known_hosts to get past a host key warningIt discards every verified key at once, and you lose the protection against man-in-the-middle attacks for all hosts.
ssh-keygen -R 10.0.2.15 # after verifying the new keychmod 644 on a private key, or 777 on ~/.ssh on the serverssh refuses world-readable private keys, and sshd (StrictModes) ignores authorized_keys when the home, .ssh or file are writable by others.
chmod 600 ~/.ssh/id_ed25519; chmod 700 ~/.ssh; chmod 600 ~/.ssh/authorized_keysssh -A to every host to use your key further onAnyone with root on that host can use your forwarded agent to log in as you elsewhere while you're connected.
ssh -J bastion app-1 # ProxyJump keeps the key on your machineCopying the private key onto the bastion to hop furtherThe key now lives on a shared server where other admins and attackers can reach it.
Use ProxyJump (-J) or a ~/.ssh/config ProxyJump line.ssh host sudo systemctl restart app in a script, and it hangssudo asks for a password, and without a terminal it can't prompt or waits forever.
ssh -t host sudo ... interactively, or allow that command with NOPASSWD in sudoers for automationTry these on a Linux machine of your own. Each task has a hint and a solution.
Is an SSH server running in this sandbox? Check with ss whether anything listens on port 22. (In the practice sandbox ss first prints a "Cannot open netlink socket" warning, then the sockets.)
Create an ed25519 key pair with no passphrase at ~/.ssh/lab_key and show the permissions of both files.
Write a ~/.ssh/config entry so that 'ssh web' connects as ubuntu to 10.0.2.20 with ~/.ssh/lab_key through the host 'bastion'.
Write the command that forwards your local port 8080 to port 80 of 10.0.2.20 through the host bastion, in the background, with no remote shell.