SSH

SSH (Secure Shell) is the standard way to log into and run commands on a remote Linux machine over an encrypted connection - this covers the client side, config file, and basic server settings.

Networking Updated August 28, 2026

  • networking
  • ssh

Almost all remote Linux administration happens over SSH. For the authentication mechanism specifically - generating and using key pairs - see SSH Keys and Authentication; this page covers connecting, configuring the client, and the server options you're most likely to need.

Basic usage

ssh [email protected]
ssh -p 2222 [email protected]   # non-default port
ssh [email protected] "uptime"  # run one command and exit, no interactive shell

The client config file: ~/.ssh/config

Typing out user, host, port, and key path every time gets old fast - define an alias instead:

Host devbox
    HostName 192.168.1.50
    User alice
    Port 2222
    IdentityFile ~/.ssh/id_ed25519_devbox

ssh devbox

This file also accepts wildcards and shared defaults (Host * at the bottom applies to everything not matched more specifically above it), useful for setting something like ServerAliveInterval globally.

Copying files over SSH

scp file.txt alice@devbox:/home/alice/
scp -r localdir/ alice@devbox:/home/alice/remotedir/
rsync -avz localdir/ alice@devbox:/home/alice/remotedir/

rsync is generally preferable to scp for anything beyond a single small file - it only transfers changed portions of files on repeat runs, and supports resuming. See Backups for rsync used as an actual backup mechanism, not just a one-off copy.

Port forwarding

SSH can tunnel other traffic through its encrypted connection:

ssh -L 8080:localhost:80 alice@devbox

This makes localhost:8080 on your machine forward into port 80 on devbox as seen from devbox itself - commonly used to reach a service that's only bound to localhost on a remote machine (a database admin UI, an internal dashboard) without exposing it publicly.

ssh -R 9000:localhost:3000 alice@devbox

Reverse forwarding does the opposite: makes port 9000 on devbox forward back into port 3000 on your local machine - useful for temporarily exposing something running locally to a remote host.

Server-side basics: /etc/ssh/sshd_config

A handful of settings matter most for security:

PermitRootLogin no
PasswordAuthentication no
Port 22
  • PermitRootLogin no - forces logging in as a regular user and using sudo (see Sudo and Privilege) rather than connecting directly as root, which also means an attacker has to guess both a valid username and a way in.
  • PasswordAuthentication no - disables password login entirely, requiring key-based auth instead - set this only after confirming key login already works, to avoid locking yourself out.

Apply changes with:

sudo systemctl reload sshd

See Hardening Basics for these settings as part of a broader baseline security checklist, and Firewalls for restricting which addresses can even reach port 22 in the first place.