SSH & remote administration

0 / 15 lessons — 0%

Lesson 11 / 15

SSH is how nearly every command in this entire course track actually reaches a remote machine — Ansible uses it, your terminal uses it, CI/CD deploy steps use it. Worth knowing well beyond just "type the password."

ssh alice@server.example.com
ssh -p 2222 alice@server.example.com     # non-default port
ssh -i ~/.ssh/deploy_key alice@server     # a specific private key

Key-based auth replaces typing a password with a cryptographic key pair — a private key that never leaves your machine, and a public key placed on every server you need to reach.


# generate a key pair once, on your own machine
ssh-keygen -t ed25519 -C "alice@laptop"

# copy the public half to a server — appends to ~/.ssh/authorized_keys there
ssh-copy-id alice@server.example.com

Typing full ssh -p 2222 -i ~/.ssh/deploy_key alice@server.example.com every time gets old fast. ~/.ssh/config turns that into a short alias:


# ~/.ssh/config
Host prod-web1
    HostName server.example.com
    User alice
    Port 2222
    IdentityFile ~/.ssh/deploy_key


ssh prod-web1    # that's the whole command now

Hardening step	Why
`PasswordAuthentication no` in `/etc/ssh/sshd_config`	Forces key-based auth — no password to brute-force
`PermitRootLogin no`	Root must log in as a normal user then sudo, not directly
Change the default port (optional, minor)	Cuts down noisy automated scanning, not a real security boundary alone

Test a new SSH config in a second terminal before closing your first session. A typo in sshd_config that breaks login, applied while your only session is that same connection, can lock you out of a remote box entirely.

Try it yourselfSet up key-based auth to any test server you control, confirm ssh yourserver logs in with no password prompt, then add a Host alias for it in ~/.ssh/config. Future-you will thank present-you the tenth time you connect.

← Lesson 10 Next: Lesson 12 →