> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/linux-server-administrator/servers-configurations-centos7/ssh-secure-shell.md).

# SSH (Secure Shell)

SSH (Secure Shell) is a protocol used to securely access and manage servers remotely. It provides encrypted communication over the internet and is commonly used for secure file transfers between systems.

***

### SSH Client

To install the SSH client:

```bash
yum install openssh-clients
```

To establish a connection using the IP address:

```bash
ssh username@remote_server_ip
```

To specify a port number when connecting:

```bash
ssh -p port_number username@remote_server_ip
```

To connect using a public key:

```bash
ssh -i ~/.ssh/id_rsa username@remote_server_ip
```

***

### SSH Server

To install the SSH server:

```bash
yum install openssh-server
```

To start and enable the SSH service:

```bash
systemctl enable sshd.service
systemctl start sshd.service
```

To allow SSH through the firewall:

```bash
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
```

Save the iptables configuration:

```bash
iptables-save
```

Restart the iptables service:

```bash
systemctl restart iptables.service
```

#### Configure SSH

**Change Default SSH Port**

1. Open the SSH configuration file:

   ```bash
   vim /etc/ssh/sshd_config
   ```
2. Locate and modify the following line (remove `#` to uncomment):

   ```
   Port your_desired_port_number
   ```
3. Allow the specified port in the firewall:

   ```bash
   iptables -A INPUT -p tcp --dport your_desired_port_number -j ACCEPT
   ```
4. Save iptables configuration:

   ```bash
   iptables-save
   ```
5. Restart the iptables service:

   ```bash
   systemctl restart iptables.service
   ```
6. Restart the SSH service to apply the changes:

   ```bash
   systemctl restart sshd.service
   ```

**Bind SSH to a Specific IP**

1. Open the SSH configuration file:

   ```bash
   vim /etc/ssh/sshd_config
   ```
2. Locate and modify the following line (remove `#` to uncomment):

   ```
   ListenAddress your_server_ip
   ```
3. Restart the SSH service to apply the changes:

   ```bash
   systemctl restart sshd.service
   ```

**Disable Root Login**

1. Open the SSH configuration file:

   ```bash
   vim /etc/ssh/sshd_config
   ```
2. Locate and modify:

   ```
   PermitRootLogin no
   ```
3. Restart the SSH service to apply the changes:

   ```bash
   systemctl restart sshd.service
   ```

**Enable Public Key Authentication**

1. Open the SSH configuration file:

   ```bash
   vim /etc/ssh/sshd_config
   ```
2. Modify the following settings:

   ```
   PubkeyAuthentication yes
   PasswordAuthentication no
   ```
3. Restart the SSH server:

   ```bash
   systemctl restart sshd.service
   ```

#### Generate and Use SSH Keys

1. Generate an SSH key pair on the user’s local system:

   ```bash
   ssh-keygen
   ```

   Follow the prompts to specify a save location and passphrase.
2. Navigate to the SSH directory:

   ```bash
   cd ~/.ssh
   ```
3. Set proper permissions for the key files:

   ```bash
   chmod 600 ~/.ssh/id_rsa
   chmod 644 ~/.ssh/id_rsa.pub
   ```
4. Move the public key to authorized keys:

   ```bash
   mv id_rsa.pub authorized_keys
   ```
5. Copy the public key to the remote server:

   ```bash
   scp ~/.ssh/id_rsa username@remote_server_ip:~/.ssh/
   ```
6. Restart the SSH service to apply the changes:

   ```bash
   systemctl restart sshd.service
   ```