DEV Community

sergio gómez
sergio gómez

Posted on

SSH: How It Works and Basic Best Practices

#devops #security #tutorial #beginners

SSH: How It Works and Basic Best Practices

The SSH (Secure Shell) protocol is the standard tool for managing servers remotely and securely. It allows users to connect to machines anywhere in the world, run commands, transfer files, and create encrypted tunnels without exposing plain‑text passwords. In this article we explain, in a practical and straightforward way, the principles that make SSH possible and the essential recommendations for using it safely.

What Is SSH and How Is a Secure Connection Established?

SSH is a network protocol that encrypts every remote session, guaranteeing confidentiality and integrity of the transmitted data (Source [2]). When a client initiates a connection, a key exchange takes place using the Diffie‑Hellman algorithm, which creates a unique session key without sending it over the network (Source [1]).

Once the key is established, the server and the client authenticate each other. The most secure method is public‑key authentication: the client holds a private key and the server stores the corresponding public key. During authentication the server sends a challenge that only the private key can solve, avoiding the use of vulnerable passwords (Source [6]).

The protocol also supports certificate‑based authentication, but the most common practice is key‑based authentication.

Main Uses of SSH in Remote Administration

  • Command‑line access: The most basic function is opening a terminal on the remote server and executing commands as if you were sitting in front of it (Source [3]).
  • File transfer: With scp or sftp you copy files securely, replacing insecure protocols like FTP (Source [5]).
  • Tunnels and port forwarding: SSH can redirect local or remote ports, creating tunnels that make internal services reachable without exposing them directly to the Internet (Source [5]).
  • Key management and automation: SSH keys facilitate task automation in scripts and deployments, eliminating the need to enter passwords manually (Source [7]).
  • Windows compatibility: In Windows environments the functionality is available through clients such as OpenSSH or PuTTY, extending its reach to users of different operating systems (Source [5]).

Essential Commands for Working with SSH

Below are some of the most useful commands that every administrator should know (Source [4]):

Command Use Example
ssh usuario@host Starts an interactive session ssh admin@192.168.1.10
scp archivo usuario@host:/ruta Copies a file to the server scp index.html admin@192.168.1.10:/var/www/
sftp usuario@host Opens an SFTP session for file management sftp admin@192.168.1.10
ssh -L puerto_local:destino:puerto_remoto usuario@host Local port forwarding ssh -L 8080:localhost:80 admin@192.168.1.10
ssh-keygen -t rsa -b 4096 Generates an RSA key pair —
ssh-copy-id usuario@host Copies the public key to the server ssh-copy-id admin@192.168.1.10

Mastering these commands enables you to perform most administration tasks without relying on graphical interfaces or external tools.

Basic Best Practices to Protect Your SSH Connections

  1. Use public‑key authentication

    Replace passwords with key pairs. Generate keys of at least 2048 bits; if the environment permits, using 4096 bits provides a larger security margin. Protect the private key with a passphrase (Source [6]).

  2. Copy the public key to the server

    Use ssh-copy-id or manually add the key to the ~/.ssh/authorized_keys file on the server (Source [6]).

  3. Disable password authentication

    In sshd_config set PasswordAuthentication no and restrict access to specific users (Source [6]).

  4. Change the default port

    Moving SSH to a non‑standard port (e.g., 2222) reduces exposure to automated attacks that scan port 22 (Source [5]).

  5. Keep the software up to date

    Regularly apply updates for OpenSSH and the operating system to incorporate fixes for known vulnerabilities.

  6. Use intrusion‑detection tools

    Deploy solutions such as Fail2Ban to block repeated login attempts and protect against brute‑force attacks (a practice recommended in most security guides).

Following these recommendations helps minimize the risks associated with remote access and preserves the integrity of your systems.

Sources and references

Top comments (0)