SSH and the Endless Connectivity

In the console post I left you a promise: everything we did was sat in front of the machine, but in the real world you almost never are. You’re at your desk — or on your sofa, or in a car park with a laptop on the bonnet — and the machine is in a rack across town, or a data centre on another continent. SSH is how you close that gap, and it’s arguably the single most useful trick a field tech, developer or sysadmin can own.

It also sits exactly where our two series meet: the Networking series gave you the wire and the ports; the Linux series gave you the shell. SSH is the bit that reaches down the one to hand you the other.

What SSH actually is

SSH — Secure Shell — gives you a shell on a remote machine over an encrypted connection. That’s the whole pitch: the same user@host:~$ prompt from the console post, except the machine might be a thousand miles away and every keystroke and every line of output travels sealed inside encryption nobody in between can read.

flowchart LR
  YOU["Your laptop (ssh client)"] ==>|"encrypted tunnel - TCP port 22"| SRV["Remote server (sshd) - a shell"]

Under the hood it’s nothing exotic — just a TCP connection to port 22 on the far machine (remember ports from the Networking series?). What makes it secure is that both ends agree on encryption before a single useful byte flows. It replaced telnet, the bad old way, which did the same job in plaintext — your password strolling across the network in the clear for anyone to read. Telnet is why we couldn’t have nice things; SSH is why we can now.

Your first connection

The command is as simple as it gets: ssh user@host. The first time you connect to a machine, though, you’ll get a slightly alarming question:

$ ssh [email protected]
The authenticity of host 'web01.example.com (203.0.113.10)' can't be established.
ED25519 key fingerprint is SHA256:9f3c...c2a1.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
mitch@web01:~$          # you're in - same shell, different continent

Don’t panic — that’s SSH doing its job. It’s showing you the server’s unique fingerprint and asking “have you seen this machine before?” Say yes and it remembers it (in ~/.ssh/known_hosts); from then on, if that fingerprint ever changes, SSH throws a very loud warning — because a changed fingerprint can mean someone’s sitting in the middle impersonating your server.

Stop using passwords: SSH keys

You can log in with a password, but you shouldn’t — and once you’ve felt the alternative you won’t want to. SSH keys come in pairs: a private key that never, ever leaves your machine, and a public key you can hand out freely. Anything the public key locks, only the private key opens. Put your public key on a server and it will let your private key in — no password, and nothing brute-forceable travelling the wire.

# 1. make a key pair (once, on your machine)
$ ssh-keygen -t ed25519 -C "mitch@laptop"

# 2. copy the PUBLIC half up to the server
$ ssh-copy-id mitch@web01

# 3. connect - no password, just the key
$ ssh mitch@web01
mitch@web01:~$

Three steps, once: generate a pair, copy the public half up, connect. After that ssh web01 just lets you in — faster and far safer than a password a bot can guess a thousand times a second.

The config file that changes your life

Typing ssh [email protected] -p 2222 -i ~/.ssh/work_key forty times a day is nobody’s idea of fun. Enter ~/.ssh/config — a little address book where you name a connection once and then forget the details:

Host web01
    HostName 203.0.113.10
    User mitch
    Port 22
    IdentityFile ~/.ssh/id_ed25519

Define it once and ssh web01 carries the hostname, user, port and key for you — and tab-completion works on the names. It’s the first thing seasoned folk set up on a new laptop, and the first thing beginners have never heard of.

More than a shell — the endless bit

Here’s where the title earns itself. That same secure channel carries far more than a shell:

# copy a file down the same secure pipe
$ scp mitch@web01:/var/log/nginx/error.log ./

# make web01's internal :80 appear on your laptop's :8080
$ ssh -L 8080:localhost:80 web01

# reach a private box by hopping through a bastion, in one line
$ ssh -J bastion web01

Copy files with scp/sftp — same credentials, same encryption. Tunnel a service with -L — make a database or dashboard that only listens on the remote network appear on your localhost, as if it were running under your desk. That’s the “endless connectivity”: if you can SSH to a box, you can reach anything it can reach. And hop through a bastion with -J to get at machines with no public address at all.

flowchart LR
  YOU["Your laptop"] -->|ssh| BAS["Bastion (public gateway)"]
  BAS -->|ssh| A["web01 (private)"]
  BAS -->|ssh| B["db01 (private)"]

That last one is the shape of most real networks: one locked-down jump host facing the world, everything important tucked safely behind it with no direct route in.

One honest caveat, since we keep tying this back to the Networking series: everything above is the full-fat SSH you get to a Linux or Unix host. SSH to a switch or router is a leaner creature — usually password-only, rarely any file transfer or tunnelling, just a management command line for changing config. And actually getting onto that switch in the first place — console cables, default addresses and all — is a rite of passage of its own: a “connecting to the switch” 101 for another day.

Locking it down

SSH is a door into your server, so it’s worth fitting a decent lock. The single biggest win is to stop accepting passwords at all — once your keys work, turn password auth off and the endless tide of bots guessing root / password123 simply bounces off. A few lines in the server’s /etc/ssh/sshd_config:

PasswordAuthentication no      # keys only
PermitRootLogin no             # no direct root login
AllowUsers mitch               # only these users may connect

# then apply:  sudo systemctl restart ssh

Beyond that, the sensible layers: PermitRootLogin no so nobody logs straight in as root (you sudo up once you’re in); fail2ban to auto-ban IPs that keep knocking; firewall rules to limit who can even reach port 22 (which lands us neatly at the firewalls post to come); and the eternal rule — keep it patched. A non-standard port is fine for tidiness, but treat it as a speed bump, not a lock.

The one-sentence version

SSH is an encrypted shell on any machine anywhere: connect with ssh user@host, log in with keys not passwords, let ~/.ssh/config remember the details, and lean on it for far more than a shell — files, tunnels, and jumps through bastions. Fit it with a good lock and it’s the most liberating tool you’ll own.

And that closes the loop between our two series: Networking gave you the wire, Linux gave you the shell, and SSH is the handshake between them. Every command here lives in the new SSH Cheatsheet for when you just need the incantation. Back in the Linux series next, we stay on one machine and open up the filesystem properly.