Knowledge Base

SSH (Secure Shell) is a protocol that allows us to securely connect to another computer over the network. It is an indispensable tool for Linux system administrators and developers. In this article, we will examine what SSH is, how it works, its basic commands, and its usage in detail. Our aim is to ensure that everyone, from beginners to advanced users, has comprehensive knowledge about SSH.

1. Introduction to SSH: Basic Concepts and Working Principle

1.1. What is SSH?

SSH (Secure Shell) is a network protocol that secures data exchange by establishing an encrypted connection between two computers. It is primarily used to access a remote server, run commands, and transfer files. SSH has replaced older and insecure protocols such as telnet and rsh.

1.2. How SSH Works

SSH is based on a client-server architecture. An SSH client (e.g., a computer) connects to an SSH server (e.g., a remote server). The following steps are followed when establishing a connection:

1. Client sends a connection request: The client sends a connection request to the server.
2. Server requests authentication information: The server requests authentication information from the client (e.g., username and password or SSH key).
3. Authentication: The client sends the authentication information to the server.
4. Connection established: If authentication is successful, an encrypted connection is established between the server and the client.

In this process, all data exchange is encrypted, thus preventing unauthorized persons from capturing the data.

1.3. Advantages of SSH

• Security: Provides a secure connection through data encryption.
• Remote Access: Offers easy access to remote servers.
• File Transfer: Can be used for secure file transfer (SCP, SFTP).
• Port Forwarding (Tunneling): Allows the secure use of insecure protocols.
• Automation: Automated tasks can be performed with scripts.

2. Basic SSH Commands and Usage

2.1. ssh Command

The ssh command is the basic command used to establish an SSH connection. Its basic usage is as follows:

ssh [username]@[server_address]

For example:

ssh [email protected]

This command attempts to connect to the server at example.com as the user username.

2.2. Password Authentication

When you run the above command, the server will ask you for a password. When you enter the correct password, you can connect to the server.

2.3. SSH Key Authentication

While password authentication is secure, SSH keys are a more secure and convenient alternative. SSH keys consist of a pair of keys: a private key (which must be kept secret) and a public key (which can be uploaded to the server).

Step 1: Generating a Key Pair

ssh-keygen -t rsa -b 4096

This command generates a 4096-bit RSA key pair. The command will ask you for a file name (defaults to ~/.ssh/id_rsa) and a passphrase (optional).

Step 2: Uploading the Public Key to the Server

ssh-copy-id [email protected]

This command copies your public key (~/.ssh/id_rsa.pub) to the ~/.ssh/authorized_keys file on the server. You may need to enter your password during this process.

Step 3: Connecting with SSH

ssh [email protected]

You can now connect to the server with your SSH key without entering a password.

2.4. scp Command (Secure Copy)

The scp command is used to securely transfer files over SSH. Its basic usage is as follows:

scp [options] [source] [destination]

For example, to copy a local file to the server:

scp file.txt [email protected]:/home/username/

To download a local file from the server:

scp [email protected]:/home/username/file.txt .

Here, "." (dot) represents the current directory.

2.5. sftp Command (Secure FTP)

The sftp command is used to start a secure FTP session over SSH. Its basic usage is as follows:

sftp [email protected]

This command connects to the server and provides an FTP-like interface. In this interface, you can use FTP commands such as get (download), put (upload), ls (list), and cd (change directory).

2.6. Port Forwarding (Tunneling)

SSH tunneling is used to securely forward an insecure connection over SSH. For example, you can forward a local port to a port on a remote server.

Local Port Forwarding

ssh -L [local_port]:[destination_server]:[destination_port] [username]@[server_address]

For example, to forward port 8080 on your local machine to port 80 on the remote server:

ssh -L 8080:localhost:80 [email protected]

Remote Port Forwarding

ssh -R [remote_port]:[destination_server]:[destination_port] [username]@[server_address]

3. SSH Configuration

3.1. ~/.ssh/config File

The ~/.ssh/config file is used to configure SSH client settings. With this file, you can define aliases for frequently used servers, specify authentication methods, and customize other settings.

For example:

Host server1
    HostName example.com
    User username
    IdentityFile ~/.ssh/id_rsa
    Port 2222

With this configuration, you can connect to the server at example.com with the user username, using the private key ~/.ssh/id_rsa, and from port 2222 by using the command ssh server1.

3.2. /etc/ssh/sshd_config File

The /etc/ssh/sshd_config file is used to configure SSH server settings. With this file, you can specify which port the SSH server will listen on, which authentication methods it will support, and other security settings.

Important settings:

• Port: Specifies the port the SSH server will listen on (22 by default).
• ListenAddress: Specifies which IP addresses the SSH server will listen on.
• PermitRootLogin: Specifies whether the root user is allowed to connect directly via SSH. (It is recommended to set it to "no" for security reasons.)
• PasswordAuthentication: Specifies whether password authentication is enabled. (It is recommended to set it to "no" if SSH keys are used.)
• PubkeyAuthentication: Specifies whether SSH key authentication is enabled.
• AllowUsers: Specifies the users who are allowed to connect via SSH.
• DenyUsers: Specifies the users who are not allowed to connect via SSH.

After changing this file, you need to restart the SSH server:

sudo systemctl restart sshd

4. SSH Security

4.1. Using Strong Passwords

If you are using password authentication, it is important to use strong and unique passwords. Use a combination of uppercase letters, lowercase letters, numbers, and symbols in your passwords, and avoid easily predictable words.

4.2. Using SSH Keys

SSH keys are a more secure authentication method than passwords. Using SSH keys provides better protection against brute-force attacks.

4.3. Disabling Root Login

Prevent the root user from connecting directly via SSH by setting PermitRootLogin no in the /etc/ssh/sshd_config file. Instead, connect with a normal user and escalate to root privileges using the sudo command.

4.4. Changing the Port

Using a different port instead of the default SSH port (22) can help prevent automated attacks. Change the Port setting in the /etc/ssh/sshd_config file.

4.5. Using a Firewall

Use a firewall (e.g., ufw or iptables) to allow access to the SSH port only from specific IP addresses.

4.6. Regularly Updating

Keep the SSH server and client updated regularly to close security vulnerabilities.

5. Real-Life Examples and Case Studies

5.1. Remote Access to a Web Server

Using SSH to manage a web server is a common practice. Developers can connect to the server via SSH to make code updates, manage the database, and configure server settings.

Example: A web developer uses SSH to upload a new version of a website to the server. They copy the files to the server with the scp command and connect to the server via SSH to make the necessary configuration changes.

5.2. Database Management

SSH can be used to remotely access and manage database servers. The database can be accessed over a secure connection via SSH tunneling.

Example: A database administrator connects to a remote database server via SSH tunneling to take a database backup and monitor database performance.

5.3. Cloud Server Management

SSH is commonly used to access and manage cloud servers. Cloud providers often recommend the SSH key authentication method.

Example: A system administrator connects to a cloud server such as Amazon EC2 or Google Cloud Compute Engine via SSH to configure the server, set up firewall settings, and install the necessary software.

6. SSH Statistics and Comparisons

6.1. SSH Protocol Versions Comparison

There are two main versions of the SSH protocol: SSH-1 and SSH-2. SSH-2 is more secure and more advanced than SSH-1.

6.2. SSH Usage Statistics

SSH is one of the most popular remote access protocols among network administrators and system engineers. Thanks to its security and flexibility, it is used in many different fields.

7. Visual Explanations

SSH Connection Diagram (Textual Description):

An SSH connection is established between a client (e.g., the user's computer) and a server (e.g., a remote server). The client sends a connection request to the server. The server requests authentication information from the client. The client sends the authentication information to the server. If authentication is successful, an encrypted connection is established between the server and the client. All data exchange takes place over this encrypted connection.

8. Frequently Asked Questions

• 8.1. Why is the SSH port 22?
• Port 22 is the standard port assigned to SSH by IANA (Internet Assigned Numbers Authority). However, it is possible to change this port for security reasons.
• 8.2. How to generate an SSH key?
• An SSH key is generated with the ssh-keygen command. This command generates a private key and a public key. The private key must be kept secret, and the public key must be uploaded to the server.
• 8.3. What is SSH tunneling and how is it used?
• SSH tunneling is used to securely route an insecure connection over SSH. For example, you can forward a local port to a port on a remote server.
• 8.4. Why is the SSH connection being refused?
• There may be several reasons why the SSH connection is being refused: incorrect username or password, the SSH server is not running, the firewall is blocking the SSH port, or there is a problem with the SSH server configuration.
• 8.5. How can I improve SSH security?
• To improve SSH security, use strong passwords, use SSH keys, block root login, change the port, use a firewall, and regularly update the SSH server.

9. Conclusion and Summary

SSH is an indispensable tool for securely accessing and managing remote systems. In this article, we have examined the basic concepts, commands, configuration, and security of SSH in detail. By using SSH correctly, you can securely manage your systems and increase the security of your network. Remember, security should always be a priority, and it is important to follow best practices when using SSH.