> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/linux-server-administrator/servers-configurations-debian/ssh-secure-shell.md).

# SSH(Secure Shell)

SSH (Secure Shell) is commonly used to access and manage remote servers over the internet securely. It provides encrypted communication for secure file transfers and remote administration.

***

### SSH Client

Install SSH Client

```bash
apt install openssh-client
```

Establishing SSH Connections

```bash
ssh username@remote_server_ip
```

Connect Using a Specific Port

```bash
ssh -p port_number username@remote_server_ip
```

Connect Using a Public Key

```bash
ssh -i ~/.ssh/id_rsa username@remote_server_ip
```

***

### SSH Server

Install SSH Server

```bash
apt install openssh-server
```

Start and Enable SSH Service

```bash
systemctl enable ssh.service
systemctl start ssh.service
```

**Change Default SSH Port**

1. Open the SSH configuration file:

   ```bash
   vim /etc/ssh/sshd_config
   ```
2. Locate and modify the following line (remove `#` to uncomment):

   ```
   Port your_desired_port_number
   ```
3. Restart the SSH server to apply changes:

   ```bash
   systemctl restart ssh.service
   ```

**Bind SSH to a Specific IP**

1. Open the SSH configuration file:

   ```bash
   vim /etc/ssh/sshd_config
   ```
2. Locate and modify the following line (remove `#` to uncomment):

   ```
   ListenAddress your_server_ip
   ```
3. Restart the SSH server to apply changes:

   ```bash
   systemctl restart ssh.service
   ```

**Disable Root Login**

1. Open the SSH configuration file:

   ```bash
   vim /etc/ssh/sshd_config
   ```
2. Locate and change:

   ```
   PermitRootLogin no
   ```
3. Restart the SSH server to apply changes:

   ```bash
   systemctl restart ssh.service
   ```

**Enable Public Key Authentication**

1. Open the SSH configuration file:

   ```bash
   vim /etc/ssh/sshd_config
   ```
2. Modify the following settings:

   ```
   PubkeyAuthentication yes
   PasswordAuthentication no
   ```
3. Restart the SSH server:

   ```bash
   systemctl restart ssh.service
   ```

#### Generate and Use SSH Keys

1. Switch to the user account that needs SSH access and generate an SSH key:

   ```bash
   ssh-keygen -f ~/.ssh/new_ssh_key_filename
   ```

   or simply:

   ```bash
   ssh-keygen
   ```

   Follow the prompts to specify a save location and passphrase.
2. Navigate to the SSH directory:

   ```bash
   cd ~/.ssh
   ```
3. Set proper permissions for the key files:

   ```bash
   chmod 600 ~/.ssh/id_rsa
   chmod 644 ~/.ssh/id_rsa.pub
   ```
4. Rename the public key for authentication:

   ```bash
   mv id_rsa.pub authorized_keys
   ```
5. Transfer the private key to the remote server:

   ```bash
   scp ~/.ssh/id_rsa username@remote_server_ip:~/.ssh/
   ```
6. Restart the SSH server:

   ```bash
   systemctl restart ssh.service
   ```