Day 10 - SSH, Keys, and Secure File Transfer

Secure Shell provides encrypted remote login and file transfer. This lesson covers key generation, agent setup, per host configuration, safe permissions, copying public keys to servers, verifying host keys, and moving files with scp and rsync. It also shows useful port forwarding patterns and reliability settings.

Prerequisites

• Day 1 through Day 9 completed
• A test VM that can accept SSH or a second machine on the network

Generate a key pair

Use an Ed25519 key for most cases. Add a comment to identify the key.

1

ssh-keygen -t ed25519 -C "majd@laptop" -f ~/.ssh/id_ed25519

Prompts:

• passphrase: protects the private key at rest
• files created: ~/.ssh/id_ed25519 and ~/.ssh/id_ed25519.pub

Set correct permissions.

1
2
3

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub

Load the key into ssh-agent

The agent holds decrypted keys in memory so repeated logins do not ask for the passphrase.

1
2
3
4
5
6
7
8

# start an agent in the current shell if not already running
eval "$(ssh-agent -s)"

# add the key
ssh-add ~/.ssh/id_ed25519

# list keys currently loaded
ssh-add -l

Desktop environments often start an agent automatically. Keys can be loaded on first use by entering the passphrase.

Copy the public key to a server

Use ssh-copy-id when available. The target must allow password login once to install the public key.

1

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server

Manual method if ssh-copy-id is not present:

1

cat ~/.ssh/id_ed25519.pub | ssh user@server 'mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys'

Test login.

1

ssh user@server

1
2
3
4
5

PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin prohibit-password
MaxAuthTries 3
LoginGraceTime 30

1

sudo sshd -t && sudo systemctl restart sshd 2>/dev/null || sudo systemctl restart ssh

Verify host keys and known hosts

On first connect, SSH records the server fingerprint in ~/.ssh/known_hosts. Verify the fingerprint out of band when possible.

1
2

ssh -o StrictHostKeyChecking=ask user@server
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub 2>/dev/null | awk '{print $2, $3}'

If a host key changes unexpectedly, SSH warns about a potential attack. Investigate before accepting the new key.

Per host settings in ~/.ssh/config

Create a configuration file to avoid long command lines and to set safe defaults.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

mkdir -p ~/.ssh
chmod 700 ~/.ssh

cat > ~/.ssh/config <<'EOF'
Host server
  HostName 203.0.113.10
  User user
  IdentityFile ~/.ssh/id_ed25519
  ServerAliveInterval 30
  ServerAliveCountMax 4
  AddKeysToAgent yes
  IdentitiesOnly yes

# jump host example
Host bastion
  HostName 198.51.100.5
  User admin

Host app-*
  User deploy
  ProxyJump bastion
  IdentityFile ~/.ssh/id_ed25519
  Compression yes
  ForwardAgent no
EOF
chmod 600 ~/.ssh/config

Now connect with a short name.

1
2

ssh server
ssh app-01

1
2
3
4

Host *
  ControlMaster auto
  ControlPath ~/.ssh/ctl-%C
  ControlPersist 10m

Copy files with scp

scp copies files over SSH. Basic patterns:

1
2
3
4
5
6
7
8

# upload
scp local.txt user@server:/home/user/

# download
scp user@server:/var/log/syslog ./

# copy a directory recursively
scp -r site/ user@server:/var/www/site/

Flags:

• -P port number when the server does not use 22
• -i identity file if not in config
• -C compression for text heavy transfers

Sync directories with rsync over SSH

rsync is efficient for repeated transfers. It sends only changed blocks.

1
2
3
4
5
6
7
8

# archive mode, verbose, compress, show progress
rsync -avzP -e ssh ./site/ user@server:/srv/site/

# delete files on the destination that no longer exist locally (use with care)
rsync -avzP --delete -e ssh ./site/ user@server:/srv/site/

# use a non default port
rsync -avzP -e 'ssh -p 2222' ./data/ user@server:/srv/data/

Trailing slashes matter:

• ./site/ copies the contents into /srv/site/
• ./site creates a subdirectory /srv/site/site

Port forwarding and jump hosts

Local forwarding exposes a remote service on a local port.

1
2

# open localhost:8080 to reach remote 127.0.0.1:80
ssh -L 8080:127.0.0.1:80 user@server

Remote forwarding exposes a local service to the remote host.

1
2

# on the client, expose local 3000 as remote 9000
ssh -R 9000:127.0.0.1:3000 user@server

Dynamic forwarding creates a SOCKS proxy on localhost.

1

ssh -D 1080 user@server

Jump through a bastion host with -J or ProxyJump.

1

ssh -J bastion user@app-01

Keep sessions healthy

Add keepalives to reduce disconnects on idle links.

1
2
3
4
5
6
7

# client side in ~/.ssh/config
ServerAliveInterval 30
ServerAliveCountMax 4

# server side in /etc/ssh/sshd_config
ClientAliveInterval 60
ClientAliveCountMax 3

Practical lab

1. Generate a key and install it on the target server.

1
2
3

ssh-keygen -t ed25519 -C "lab@client"
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server
ssh user@server 'echo ok'

2. Create a per host entry and test a short ssh command.

1
2
3
4
5
6
7
8
9

cat >> ~/.ssh/config <<'EOF'
Host lab
  HostName server
  User user
  IdentityFile ~/.ssh/id_ed25519
  ServerAliveInterval 30
  IdentitiesOnly yes
EOF
ssh lab 'uname -a'

3. Transfer files with scp and rsync.

1
2

scp /etc/hosts lab:/tmp/hosts.copy
rsync -avzP -e ssh /etc/ lab:/tmp/etc-copy/ --dry-run

4. Try a local port forward to view a remote web app.

1
2

ssh -L 8080:127.0.0.1:80 lab
# then open http://127.0.0.1:8080 in a browser from the client

Troubleshooting

• Permission denied (publickey) The public key is missing from authorized_keys, permissions are too open, or the wrong identity is used. Check -i, IdentitiesOnly yes, and directory modes: ~/.ssh 700, authorized_keys 600.
• Host key mismatch after a server rebuild. Remove the old line for that host from ~/.ssh/known_hosts only after confirming the new fingerprint out of band.
• Slow logins. Check DNS reverse lookups on the server. Disable with UseDNS no in sshd_config if appropriate, or fix name resolution.
• scp permission errors to system paths. Upload to a home directory, then use sudo on the server to move files with the correct ownership.
• rsync transfers no files. Confirm the trailing slash usage and that the remote path exists and is writable.

Next steps

Day 11 introduces disks and filesystems. It covers lsblk, partitions versus filesystems, mounting with mount and /etc/fstab, checking space with df and du, and a safe workflow to add a second disk in a VM.