Chapter 25: SSH Configuration

In this chapter, we’ll dive into advanced SSH configuration, including how to generate SSH keys, customize SSH behavior, and use SSH tunneling. By the end of this chapter, you’ll be able to securely manage remote access, simplify SSH connections, and create secure tunnels for accessing services.

1. Why Learn Advanced SSH Configuration?

SSH (Secure Shell) is the standard tool for securely accessing remote systems. Advanced configuration allows you to: - Simplify remote access with aliases and key-based authentication. - Secure your connections with encryption and tunneling. - Automate tasks and improve productivity.

2. Generating SSH Keys

SSH keys provide a more secure alternative to password-based authentication.

Generate an RSA Key

$ ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

• -t rsa: Specifies the key type (RSA).
• -b 4096: Specifies the key length (4096 bits).
• -C: Adds a comment (usually your email).

Generate an ed25519 Key

$ ssh-keygen -t ed25519 -C "your_email@example.com"

• -t ed25519: Specifies the key type (ed25519, a modern and secure algorithm).

Copy the Public Key to a Remote Server

Use ssh-copy-id to copy your public key to a remote server:

$ ssh-copy-id user@remote_host

3. Customizing SSH with ~/.ssh/config

The ~/.ssh/config file allows you to customize SSH behavior and create aliases for remote hosts.

Example Configuration

Host myserver
    HostName 192.168.1.100
    User amar
    IdentityFile ~/.ssh/id_ed25519
    Port 2222

Now, you can connect using:

$ ssh myserver

Common Options

• HostName: The remote host’s IP address or domain name.
• User: The username to log in as.
• IdentityFile: The path to your private key.
• Port: The SSH port (default is 22).

4. SSH Tunneling

SSH tunneling allows you to securely access services on a remote network.

Local Port Forwarding

Forward a local port to a remote server:

$ ssh -L 8080:localhost:80 user@remote_host

• 8080: Local port.
• localhost:80: Remote server and port.

Now, you can access the remote service on localhost:8080.

Remote Port Forwarding

Forward a remote port to your local machine:

$ ssh -R 8080:localhost:80 user@remote_host

• 8080: Remote port.
• localhost:80: Local server and port.

Now, the remote server can access your local service on localhost:8080.

5. Practical Examples

Set Up SSH Key Authentication

1. Generate an SSH key: 
   $ ssh-keygen -t ed25519 -C "your_email@example.com"
2. Copy the public key to a remote server: 
   $ ssh-copy-id user@remote_host
3. Test the connection: 
   $ ssh user@remote_host

Create an SSH Alias

Edit ~/.ssh/config:

Host myserver
    HostName 192.168.1.100
    User amar
    IdentityFile ~/.ssh/id_ed25519

Connect using:

$ ssh myserver

Create an SSH Tunnel

Forward a local port to a remote web server:

$ ssh -L 8080:localhost:80 user@remote_host

Access the remote web server on localhost:8080.

Modern SSH tools like mosh maintain persistent connections, even during network changes, ensuring reliable remote access. Sshuttle can create a makeshift VPN over SSH, providing secure access to private networks. 

For key management, ssh-agent and keychain allow you to unlock your private key once, streamlining access to multiple servers. These enhancements bring added resilience and convenience to SSH usage, particularly for users frequently switching between networks or managing multiple machines.

$ mosh user@remote_host

Practice Time!

Let’s put your new skills to the test: 
1. Generate an SSH key and configure key-based authentication for a remote server. 2. Create an SSH alias in ~/.ssh/config to simplify remote access. 
3. Set up an SSH tunnel to access a remote service securely.

That’s it for Chapter 31! You’ve now learned how to configure SSH for secure remote access, simplify connections with aliases, and create secure tunnels. In the next chapter, we’ll dive into mastering tmux—how to use this powerful terminal multiplexer to manage multiple sessions, windows, and panes. Until then, practice these SSH techniques to become more comfortable with remote access.

Prev: Chapter 24 | Next: Chapter 26